Cloud Foundry Uaa Release
Approved changes feed: RSS · Atom
cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pivotal Software (a7eef617-cad9-5400-bbf0-2e56b16d90a7) |
|---|---|
| Product | Cloud Foundry Uaa Release (2353c17f-e306-53cd-93e5-f814b42f9069) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cloudfoundry/uaa |
purl2cpe | 2026-06-01 10:11:00.603864 |
pkg:rpm/opensuse/uaa |
purl2cpe | 2026-06-01 10:11:00.603868 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-3787 |
vulnerable | 2026-06-08 05:13:55.997096 |
UAA defaults email address to an insecure domain
HIGH (8.3)
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
Published: 2019-06-19T22:28:07.316Z
Updated: 2024-09-16T21:57:57.203Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11268 |
vulnerable | 2026-06-08 05:12:36.772402 |
UAA SQL Identity Zone Vulnerability
MEDIUM (6.5)
Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.
Published: 2019-07-11T18:11:36.916Z
Updated: 2024-09-17T03:13:54.242Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-15754 |
vulnerable | 2026-06-08 05:11:03.450891 |
UAA can issue tokens across identity providers if users with matching usernames exist
MEDIUM (4.2)
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
Published: 2018-12-13T22:00:00.000Z
Updated: 2024-09-16T17:24:01.117Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11041 |
vulnerable | 2026-06-08 05:10:37.712597 |
Details available
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.
Published: 2018-06-25T15:00:00.000Z
Updated: 2024-09-16T23:11:54.199Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-5016 |
vulnerable | 2026-06-08 05:07:56.016895 |
Details available
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Published: 2017-04-24T19:00:00.000Z
Updated: 2024-08-06T00:46:40.228Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.