3 results · Clear filters · Feed
-
Medium 4.3
UAA is vulnerable to a Blind SCIM injection leading to information disclosure
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of t…
-
Medium 4.2
UAA can issue tokens across identity providers if users with matching usernames exist
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of thes…
-
Medium 6.6
Cloud Foundry UAA MFA does not prevent brute force of MFA code
Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login a…