Cloud Foundry
Monthly
Broken access control in the Cloud Foundry Cloud Controller API leaves the /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed callback endpoints reachable on the public API listener, because the shipped Nginx routing configuration carries deny rules for /internal/v4/ and /internal/v5/ but omits the equivalent rule for /internal/v3/. An attacker who holds a valid build or droplet GUID - and a SpaceAuditor can enumerate those GUIDs without any write permission - can post a forged staging callback, transition a droplet to STAGED, and persist arbitrary process and sidecar metadata with no associated package or actor, escalating past the intended role boundary. No public exploit code was identified at time of analysis, and the vendor has published fixed versions; triage guidance places remediation in this week's work rather than an emergency response.
Improper authentication in the OAuth token endpoint of Cloud Foundry UAA (CWE-287) enables an authenticated remote attacker to exchange a low-privileged user access token for a fully-privileged client_credentials token, bypassing the need for the client secret. The attacker must possess a valid user token for an OAuth client that is configured to support both a public authorization_code+PKCE flow and the client_credentials grant on the same client_id, a non-default combination; the resulting client token carries the client's full authorities (e.g., clients.write), allowing creation of arbitrary OAuth clients. No public exploit code has been identified at time of analysis, and exploitation requires authenticated user access, with impact scaling to the authorities assigned to the affected client.
Improper certificate validation in Cloud Foundry's bosh-vsphere-cpi-release exposes vCenter administrator credentials to any attacker with a network position between the BOSH Director and vCenter. The vSphere CPI transmits credentials via HTTP Basic authentication on every routine cloud infrastructure operation and fails to enforce TLS certificate authenticity, allowing a rogue endpoint to impersonate the vCenter REST API and silently capture those credentials. Successful interception yields full administrative control over every virtual machine, datastore, and network segment managed by the compromised vCenter instance. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
Authentication bypass in Cloud Foundry UAA allows remote unauthenticated attackers to obtain access tokens for arbitrary users when SAML 2.0 bearer assertions are enabled, leading to unauthorized access to all UAA-protected systems. Affects UAA versions 77.30.0 through 78.7.0 and CF Deployment versions 48.7.0 through 54.14.0. The vulnerability stems from acceptance of unsigned and unencrypted SAML 2.0 assertions (CWE-290: Authentication Bypass by Spoofing), enabling complete authentication mechanism bypass with network access and low attack complexity (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, but the technical details disclosed in the vendor blog create high weaponization potential.
Cloud Foundry CAPI Release contains unprotected internal endpoints that allow attackers who have bypassed perimeter firewall controls to replace application droplets and access sensitive application data. The vulnerability affects Cloud Foundry CAPI Release version 1.226.0 and earlier, and CF Deployment version 54.9.0 and earlier across all platforms. This is an authentication bypass issue (CWE-306) with a CVSS score of 7.5, requiring adjacent network access and high attack complexity but no privileges or user interaction.
Cloud Foundry CAPI versions before v1.248.0 and CF Deployment versions before 60.9.0 allow an authenticated SpaceDeveloper to redirect a space-scoped service broker's stored credentials to an attacker-controlled endpoint by changing the broker URL while leaving its credentials unchanged. This is an indirect credential-disclosure path because the CF API does not permit direct reading of broker credentials; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7), with impact limited to confidentiality. No public exploit was identified at time of analysis, and vendor patches are available in CAPI v1.248.0 and CF Deployment 60.9.0.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Denial of service in Cloud Foundry UAA's private_key_jwt client-authentication path lets an attacker force repeated deserialization of a large cached remote JWKS object, driving excessive CPU consumption and eventual Java heap exhaustion (OutOfMemoryError) that makes the identity server unavailable. The CVSS 4.0 score is 6.9 and the impact is availability-only - no confidentiality or integrity loss - but the vector is PR:H because the attacker must first obtain write access to client configuration (to point a jwks_uri at an oversized payload) or control an already-trusted JWKS endpoint; once that condition is staged, the triggering requests are anonymous and need no interaction. Affected are UAA deployments that use private_key_jwt with a remote jwks_uri that UAA fetches and caches; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
Cloud Foundry UAA versions 4.5.0 through 79.6.0 can be induced to skip the OAuth authorization-code exchange at its external OIDC login callback and instead accept a caller-supplied id_token, when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that same zone's own /oauth/token endpoint (a non-default 'self-UAA' configuration). An attacker who already holds any valid UAA JWT for themselves - including a low-scope access token (uaa.user only) or an ID token minted for an unrelated client such as cf - plus a valid browser login state for the target zone, can present that token as the callback's id_token and be authenticated into a mapped local 'shadow' account without the token's true audience or user_id being verified. This is not a pre-authentication bug and does not by itself grant privileges beyond those of the mapped shadow account, so real impact depends entirely on that account's group memberships (which may include administrative scopes such as clients.write); no public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided in the available intelligence.
Arbitrary blobstore deletion in BOSH Director allows a compromised, high-privileged BOSH-managed VM to delete any object from the shared Director blobstore by injecting crafted NATS reply messages. All BOSH Director versions prior to v282.1.12 are affected, with the root cause being a complete absence of UUID-format validation, ownership checks, and namespace prefixing in ResourceManager before executing blobstore.delete(). An attacker leveraging this post-compromise path can corrupt or destroy deployment artifacts, compiled packages, and release binaries relied upon by dependent deployments, producing cascading availability failures across the BOSH environment. No public exploit or active exploitation has been identified at time of analysis; SSVC confirms exploitation status as none.
Path traversal in BOSH Director allows a compromised BOSH agent to cause the Director to read and delete arbitrary files outside the blobstore root on the Director host filesystem. When the Director processes long-running operations such as compile_package and is configured with the local blobstore provider, agent-supplied blob IDs in the reply JSON are passed unmodified into filesystem path construction, enabling traversal strings like '../../jobs/director/config/director.yml' to resolve to sensitive files. No public exploit exists and no active exploitation has been identified; the CVSS 4.0 score of 4.3 reflects the significant prerequisite barriers including high privilege requirements and a specific non-default configuration.
BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5;. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Broken access control in the Cloud Foundry Cloud Controller API leaves the /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed callback endpoints reachable on the public API listener, because the shipped Nginx routing configuration carries deny rules for /internal/v4/ and /internal/v5/ but omits the equivalent rule for /internal/v3/. An attacker who holds a valid build or droplet GUID - and a SpaceAuditor can enumerate those GUIDs without any write permission - can post a forged staging callback, transition a droplet to STAGED, and persist arbitrary process and sidecar metadata with no associated package or actor, escalating past the intended role boundary. No public exploit code was identified at time of analysis, and the vendor has published fixed versions; triage guidance places remediation in this week's work rather than an emergency response.
Improper authentication in the OAuth token endpoint of Cloud Foundry UAA (CWE-287) enables an authenticated remote attacker to exchange a low-privileged user access token for a fully-privileged client_credentials token, bypassing the need for the client secret. The attacker must possess a valid user token for an OAuth client that is configured to support both a public authorization_code+PKCE flow and the client_credentials grant on the same client_id, a non-default combination; the resulting client token carries the client's full authorities (e.g., clients.write), allowing creation of arbitrary OAuth clients. No public exploit code has been identified at time of analysis, and exploitation requires authenticated user access, with impact scaling to the authorities assigned to the affected client.
Improper certificate validation in Cloud Foundry's bosh-vsphere-cpi-release exposes vCenter administrator credentials to any attacker with a network position between the BOSH Director and vCenter. The vSphere CPI transmits credentials via HTTP Basic authentication on every routine cloud infrastructure operation and fails to enforce TLS certificate authenticity, allowing a rogue endpoint to impersonate the vCenter REST API and silently capture those credentials. Successful interception yields full administrative control over every virtual machine, datastore, and network segment managed by the compromised vCenter instance. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
Authentication bypass in Cloud Foundry UAA allows remote unauthenticated attackers to obtain access tokens for arbitrary users when SAML 2.0 bearer assertions are enabled, leading to unauthorized access to all UAA-protected systems. Affects UAA versions 77.30.0 through 78.7.0 and CF Deployment versions 48.7.0 through 54.14.0. The vulnerability stems from acceptance of unsigned and unencrypted SAML 2.0 assertions (CWE-290: Authentication Bypass by Spoofing), enabling complete authentication mechanism bypass with network access and low attack complexity (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, but the technical details disclosed in the vendor blog create high weaponization potential.
Cloud Foundry CAPI Release contains unprotected internal endpoints that allow attackers who have bypassed perimeter firewall controls to replace application droplets and access sensitive application data. The vulnerability affects Cloud Foundry CAPI Release version 1.226.0 and earlier, and CF Deployment version 54.9.0 and earlier across all platforms. This is an authentication bypass issue (CWE-306) with a CVSS score of 7.5, requiring adjacent network access and high attack complexity but no privileges or user interaction.
Cloud Foundry CAPI versions before v1.248.0 and CF Deployment versions before 60.9.0 allow an authenticated SpaceDeveloper to redirect a space-scoped service broker's stored credentials to an attacker-controlled endpoint by changing the broker URL while leaving its credentials unchanged. This is an indirect credential-disclosure path because the CF API does not permit direct reading of broker credentials; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7), with impact limited to confidentiality. No public exploit was identified at time of analysis, and vendor patches are available in CAPI v1.248.0 and CF Deployment 60.9.0.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Denial of service in Cloud Foundry UAA's private_key_jwt client-authentication path lets an attacker force repeated deserialization of a large cached remote JWKS object, driving excessive CPU consumption and eventual Java heap exhaustion (OutOfMemoryError) that makes the identity server unavailable. The CVSS 4.0 score is 6.9 and the impact is availability-only - no confidentiality or integrity loss - but the vector is PR:H because the attacker must first obtain write access to client configuration (to point a jwks_uri at an oversized payload) or control an already-trusted JWKS endpoint; once that condition is staged, the triggering requests are anonymous and need no interaction. Affected are UAA deployments that use private_key_jwt with a remote jwks_uri that UAA fetches and caches; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
Cloud Foundry UAA versions 4.5.0 through 79.6.0 can be induced to skip the OAuth authorization-code exchange at its external OIDC login callback and instead accept a caller-supplied id_token, when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that same zone's own /oauth/token endpoint (a non-default 'self-UAA' configuration). An attacker who already holds any valid UAA JWT for themselves - including a low-scope access token (uaa.user only) or an ID token minted for an unrelated client such as cf - plus a valid browser login state for the target zone, can present that token as the callback's id_token and be authenticated into a mapped local 'shadow' account without the token's true audience or user_id being verified. This is not a pre-authentication bug and does not by itself grant privileges beyond those of the mapped shadow account, so real impact depends entirely on that account's group memberships (which may include administrative scopes such as clients.write); no public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided in the available intelligence.
Arbitrary blobstore deletion in BOSH Director allows a compromised, high-privileged BOSH-managed VM to delete any object from the shared Director blobstore by injecting crafted NATS reply messages. All BOSH Director versions prior to v282.1.12 are affected, with the root cause being a complete absence of UUID-format validation, ownership checks, and namespace prefixing in ResourceManager before executing blobstore.delete(). An attacker leveraging this post-compromise path can corrupt or destroy deployment artifacts, compiled packages, and release binaries relied upon by dependent deployments, producing cascading availability failures across the BOSH environment. No public exploit or active exploitation has been identified at time of analysis; SSVC confirms exploitation status as none.
Path traversal in BOSH Director allows a compromised BOSH agent to cause the Director to read and delete arbitrary files outside the blobstore root on the Director host filesystem. When the Director processes long-running operations such as compile_package and is configured with the local blobstore provider, agent-supplied blob IDs in the reply JSON are passed unmodified into filesystem path construction, enabling traversal strings like '../../jobs/director/config/director.yml' to resolve to sensitive files. No public exploit exists and no active exploitation has been identified; the CVSS 4.0 score of 4.3 reflects the significant prerequisite barriers including high privilege requirements and a specific non-default configuration.
BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5;. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.