UAA privilege escalation across identity zones
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-1262US | high7.2 | — | ||
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validatio… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/cloudfoundry/uaaPACKAGE
- https://github.com/cloudfoundry/uaa/commit/14c745aa293b8d3ce9cdd6bfbc6c0ef3f269b21WEB
- https://github.com/cloudfoundry/uaa/commit/dccd3962f969913996ee88f653fce3b108c0205WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-1262ADVISORY
- https://www.cloudfoundry.org/blog/cve-2018-1262WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan