Cloud Foundry UAA MFA does not prevent brute force of MFA code
CVE-2018-11082

6.6MEDIUM

Key Information:

Vendor

Cloud Foundry

Status
Uaa Release
Uaa
Vendor
CVE Published:
5 October 2018

What is CVE-2018-11082?

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

Affected Version(s)

UAA all versions < 4.20.0

UAA Release all versions < 61.0

References

https://www.cloudfoundry.org/blog/cve-2018-11082/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.