Authorization Flaw in Cloud Foundry UAA Admin Endpoints

CVE-2018-11047

What is CVE-2018-11047?

The identified vulnerability in Cloud Foundry UAA arises from a misconfiguration that permits requests to admin endpoints, such as /Users and /Groups, to be authorized using a valid refresh token instead of the standard access token. Given that refresh tokens have extended expiration times, this could allow unauthorized access to sensitive administrative functions, especially if a user's account has not been completely removed from the system. Proper management of user statuses is critical to ensure that deleted or altered users can no longer exert control over administrative capabilities.

References