Uaa Release (Oss)

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

Published: 2019-04-25T20:17:37.272Z
Updated: 2024-09-17T02:56:41.904Z

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

Published: 2019-07-18T15:47:00.225Z
Updated: 2024-09-16T16:28:44.977Z

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.

Published: 2019-04-25T20:17:37.233Z
Updated: 2024-09-16T22:02:12.371Z

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.

Published: 2019-06-19T22:28:07.316Z
Updated: 2024-09-16T21:57:57.203Z

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

Published: 2019-03-07T19:00:00.000Z
Updated: 2024-09-16T22:31:19.423Z