Description
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloud Foundry | UAA | all versions – < 4.23.0 | 4.23.0 |
| Cloud Foundry | UAA Release | all versions – < 64.0 | 64.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | < 4.23.0 | 4.23.0 | GHSA-292x-hjr8-226f |