GHSA-xh4m-99qp-w483

Source

https://github.com/advisories/GHSA-xh4m-99qp-w483

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xh4m-99qp-w483/GHSA-xh4m-99qp-w483.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xh4m-99qp-w483

Aliases

CVE-2018-11041

Published

2022-05-14T03:05:26Z

Modified

2024-03-01T23:56:40.495696Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cloud Foundry UAA open redirect

Details

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.

Database specific

{
    "nvd_published_at": "2018-06-25T15:29:00Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-01T23:43:06Z"
}

References

Affected packages

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.5

Affected versions

3.*

3.0.0

3.0.1

3.1.0

3.2.0

3.2.1

3.3.0

3.3.0.1

3.3.0.2

3.3.0.3

3.3.0.4

3.3.0.5

3.4.0

3.4.2

3.4.3

3.4.4

3.4.5

3.5.0

3.6.0

3.7.0

3.7.3

3.8.0

3.9.0

3.9.1

3.10.0

3.12.0

3.13.0

3.15.0

3.16.0

3.18.0

3.19.0

3.20.0

4.*

4.1.0

4.2.0

4.3.0

4.4.0

4.5.0

4.5.6

4.5.7

4.5.8

4.5.9

4.6.0

4.6.1

4.7.0

4.7.1

4.7.2

4.7.4

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.8.0

Fixed

4.10.1

Affected versions

4.*

4.8.0

4.8.2

4.8.3

4.9.0

4.10.0

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.11.0

Fixed

4.12.3

Affected versions

4.*

4.11.0

4.12.0

4.12.1

4.12.2

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.13.0

Fixed

4.19.0

Affected versions

4.*

4.13.0

4.13.1

4.13.3

4.13.4

4.14.0

4.15.0

4.16.0

4.17.0

4.18.0