Description
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloud Foundry | CloudFoundry UAA | 4.12.X and 4.13.X | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >= 4.12.0, < 4.12.2 | 4.12.2 | GHSA-8v97-gv3g-32rf |
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >= 4.13.0, < 4.13.4 | 4.13.4 | GHSA-8v97-gv3g-32rf |