CVE-2018-15754
Medium
Description
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
SeverityMedium
CVSS4.2
Exploit probability—
ProductPivotal Software Cloud Foundry Uaa-release
PublishedDec 13, 2018
First seenDec 13, 2018
How to fix
Update
- pivotal_software cloud_foundry_uaa-release66.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software cloud_foundry_uaa-release | 60.0 ≤ v < 66.0 | 66.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.