UAA Privilege Escalation
CVE-2018-15761

9.9CRITICAL

Key Information:

Vendor

Cloud Foundry

Status
Uaa
Uaa Release
Vendor
CVE Published:
19 November 2018

What is CVE-2018-15761?

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.

Affected Version(s)

UAA all versions < 4.23.0

UAA Release all versions < 64.0

References

https://www.cloudfoundry.org/blog/cve-2018-15761/
x_refsource_CONFIRM

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

CVSS V3.0

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.