UAA privilege escalation across identity zones
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-1262US | high7.2 | — | ||
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validatio… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/cloudfoundry/uaaPACKAGE
- https://github.com/cloudfoundry/uaa/commit/14c745aa293b8d3ce9cdd6bfbc6c0ef3f269b21WEB
- https://github.com/cloudfoundry/uaa/commit/dccd3962f969913996ee88f653fce3b108c0205WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-1262ADVISORY
- https://www.cloudfoundry.org/blog/cve-2018-1262WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan