Description
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Cloud Foundry | release v236 and earlier versions, UAA release v3.3.0 and earlier versions, All versions of Login-server, UAA release v10 and earlier versions, Elastic Runtime versions prior to 1.7.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | < 3.3.0.1 | 3.3.0.1 | GHSA-fm5c-2rwc-887w |