Description
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloud Foundry | UAA Release (OSS) | All – < v71.0 | v71.0 |
| Pivotal | Pivotal Application Service | 2.5 – < 2.5.1 | 2.5.1 |