Cloud Foundry UAA reset password vulnerable to brute force attack

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-3084 · ADVISORY
• cloudfoundry/uaa commit 1435022 · WEB
• cloudfoundry/uaa commit 1d3ad73 · WEB
• cloudfoundry/uaa commit 460627e · WEB
• cloudfoundry/uaa commit 4a119d3 · WEB
• cloudfoundry/uaa commit 5c23774 · WEB
• cloudfoundry/uaa commit 6613292 · WEB
• cloudfoundry/uaa commit b383436 · WEB
• cloudfoundry/uaa · PACKAGE
• pivotal.io/security/cve-2016-3084 · WEB

org.cloudfoundry.identity:cloudfoundry-identity-server のその他の脆弱性

• CVE-2026-22723中 6.5Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78…
• CVE-2018-15761高 8.8Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privileg…
• CVE-2018-11047高 7.5Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4…
• CVE-2018-11041中 6.1Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior t…
• CVE-2018-1262高 7.2Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones …