| Package | Affected versions | Patched versions |
|---|---|---|
| cloud foundry uaa bosh | ≤ 16.0 | |
| cloud foundry | ≤ 242.0 | |
| cloud foundry elastic runtime | = 1.6.0= 1.6.1= 1.6.10= 1.6.11= 1.6.12= 1.6.13= 1.6.14= 1.6.15= 1.6.17= 1.6.18= 1.6.19= 1.6.2= 1.6.20= 1.6.21= 1.6.22= 1.6.23= 1.6.25= 1.6.26= 1.6.27= 1.6.28= 1.6.29= 1.6.3= 1.6.30= 1.6.31= 1.6.32= 1.6.33= 1.6.34= 1.6.35= 1.6.36= 1.6.37= 1.6.38= 1.6.39= 1.6.4= 1.6.5= 1.6.6= 1.6.7= 1.6.8= 1.6.9= 1.7.0= 1.7.1= 1.7.10= 1.7.11= 1.7.12= 1.7.13= 1.7.14= 1.7.15= 1.7.16= 1.7.17= 1.7.18= 1.7.19= 1.7.2= 1.7.20= 1.7.3= 1.7.4= 1.7.5= 1.7.6= 1.7.7= 1.7.8= 1.7.9= 1.8.0 | |
| cloud foundry ops manager | = 1.7.0= 1.7.1= 1.7.10= 1.7.11= 1.7.12= 1.7.2= 1.7.3= 1.7.4= 1.7.5= 1.7.6= 1.7.7= 1.7.8= 1.7.9= 1.8.0 | |
| cloud foundry uaa | ≤ 3.7.0 |
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allows remote authenticated users to gain privileges by leveraging possession of a token.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free