Uaa
Monthly
Privilege escalation in Cloud Foundry UAA (User Account and Authentication server) lets users who authenticate via a federated OIDC provider obtain the powerful uaa.admin scope even though operators intended to restrict that provider using the externalGroupsWhitelist configuration. The flaw manifests only when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES together with a wildcard (*) externalGroupsWhitelist entry, causing the wildcard to grant all mapped external groups as scopes - including uaa.admin. No public exploit has been identified at time of analysis, and the vulnerability requires a specific non-default IdP configuration.
Adversary-in-the-middle credential theft and privilege escalation affects Cloud Foundry UAA (User Account and Authentication server) prior to v78.13.0 and cf-deployment prior to v56.2.0, where LDAP StartTLS unconditionally disables TLS hostname verification. An attacker positioned on the network path between UAA and its LDAP directory can present any certificate issued by any trusted CA to impersonate the directory, harvesting the LDAP bind password plus every end-user password submitted during simple-bind authentication and injecting forged group memberships that grant attacker-controlled admin scopes. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS was not provided, but the CVSS 4.0 base score is 9.3 (Critical).
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Privilege escalation in Cloud Foundry UAA (User Account and Authentication server) lets users who authenticate via a federated OIDC provider obtain the powerful uaa.admin scope even though operators intended to restrict that provider using the externalGroupsWhitelist configuration. The flaw manifests only when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES together with a wildcard (*) externalGroupsWhitelist entry, causing the wildcard to grant all mapped external groups as scopes - including uaa.admin. No public exploit has been identified at time of analysis, and the vulnerability requires a specific non-default IdP configuration.
Adversary-in-the-middle credential theft and privilege escalation affects Cloud Foundry UAA (User Account and Authentication server) prior to v78.13.0 and cf-deployment prior to v56.2.0, where LDAP StartTLS unconditionally disables TLS hostname verification. An attacker positioned on the network path between UAA and its LDAP directory can present any certificate issued by any trusted CA to impersonate the directory, harvesting the LDAP bind password plus every end-user password submitted during simple-bind authentication and injecting forged group memberships that grant attacker-controlled admin scopes. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS was not provided, but the CVSS 4.0 base score is 9.3 (Critical).
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.