Pivotal Software Cloud Foundry UAA 2.7.4.14
Approved changes feed: RSS · Atom
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:*
part: a version: 2.7.4.14 update: *
| Vendor | Pivotal Software (a7eef617-cad9-5400-bbf0-2e56b16d90a7) |
|---|---|
| Product | Cloud Foundry Uaa (b53e44f3-a1a5-5023-84da-11feafc644ba) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cloudfoundry/uaa |
purl2cpe | 2026-06-01 10:11:01.065148 |
pkg:rpm/opensuse/uaa |
purl2cpe | 2026-06-01 10:11:01.065149 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-8032 |
vulnerable | 2026-06-03 14:37:38.870678 |
Details available
In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.
Published: 2017-07-10T20:00:00.000Z
Updated: 2024-08-05T16:19:29.855Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-4994 |
vulnerable | 2026-06-03 14:37:18.295831 |
Details available
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions prior to v4.3.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.16, 24.x versions prior to v24.11, 30.x versions prior to 30.4, and other versions prior to v40. There was an issue with forwarded http headers in UAA that could result in account corruption.
Published: 2017-06-13T06:00:00.000Z
Updated: 2024-08-05T14:47:43.952Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-4992 |
vulnerable | 2026-06-03 14:37:18.285262 |
Details available
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations.
Published: 2017-06-13T06:00:00.000Z
Updated: 2024-08-05T14:47:43.659Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-4991 |
vulnerable | 2026-06-03 14:37:18.277054 |
Details available
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.
Published: 2017-06-13T06:00:00.000Z
Updated: 2024-08-05T14:47:43.640Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-4974 |
vulnerable | 2026-06-03 14:37:18.205474 |
Details available
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
Published: 2017-06-13T06:00:00.000Z
Updated: 2024-08-05T14:47:43.914Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.