fkie_cve-2018-11047
Vulnerability from fkie_nvd
Published
2018-07-24 19:29
Modified
2024-11-21 03:42
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.
References
security_alert@emc.comhttps://www.cloudfoundry.org/blog/cve-2018-11047/Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cloudfoundry.org/blog/cve-2018-11047/Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "89934957-FA65-4B7C-A5FB-2FF20790C26B",
              "versionEndExcluding": "4.5.7",
              "versionStartIncluding": "4.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEFD0F0C-7C4B-43B3-B3F5-02C3162C473B",
              "versionEndExcluding": "4.7.6",
              "versionStartIncluding": "4.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E64CF7C7-EE86-4A38-AA6A-23B87E3EA453",
              "versionEndExcluding": "4.10.2",
              "versionStartIncluding": "4.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2114BFB-94D6-4F10-8A55-46D4407F5725",
              "versionEndExcluding": "4.12.4",
              "versionStartIncluding": "4.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED93DF45-D18C-4904-854F-CE53337BE912",
              "versionEndExcluding": "4.19.2",
              "versionStartIncluding": "4.19.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid."
    },
    {
      "lang": "es",
      "value": "Cloud Foundry UAA, en versiones 4.19 anteriores a la 4.19.2, versiones 4.12 anteriores a la 4.12.4, versiones 4.10 anteriores a la 4.10.2, versiones 4.7 anteriores a la 4.7.6 y versiones 4.5 anteriores a la 4.5.7, autoriza incorrectamente las peticiones a los endpoints admin aceptando un token de actualizaci\u00f3n v\u00e1lido en lugar de un token de acceso. Por dise\u00f1o, los tokens de actualizaci\u00f3n tienen un tiempo de expiraci\u00f3n mayor que los tokens de acceso, lo que permite que el poseedor de un token de actualizaci\u00f3n se autentique m\u00e1s tiempo del esperado. Esto afecta a los endpoints administrativos de UAA, p.ej., /Users, /Groups, etc. Sin embargo, si el usuario ha sido eliminado o le han eliminado grupos, o si se ha eliminado el cliente, el token de actualizaci\u00f3n ya no ser\u00e1 v\u00e1lido."
    }
  ],
  "id": "CVE-2018-11047",
  "lastModified": "2024-11-21T03:42:33.670",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-07-24T19:29:00.287",
  "references": [
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudfoundry.org/blog/cve-2018-11047/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudfoundry.org/blog/cve-2018-11047/"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.