CVE-2018-11041
mediumPriorität · verfolgen · 24EPSS 0.009 · 58. PerzentilEUUSEPSS · bewertet 2026-10-28
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (17)
Betroffene Produkte und Versionsbereiche.
- Cloud Foundry Cloud Foundry UAA≤ later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5enisa_euvdEU
- pivotal software cloud foundry uaa< 4.10.1nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa< 4.19.0nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa< 4.7.5nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa4.10.1 → 4.19.0nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa4.6.0 → 4.7.5nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa4.7.5 → 4.10.1nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa-release< 52.9nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa-release< 55.1nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa-release< 60nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa-release48 → 52.9nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa-release52.9 → 55.1nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
- pivotal software cloud foundry uaa-release55.1 → 60nvdUScpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
- Maven org.cloudfoundry.identity:cloudfoundry-identity-server< 4.7.5osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
- Maven org.cloudfoundry.identity:cloudfoundry-identity-server4.11.0 → 4.12.3osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
- Maven org.cloudfoundry.identity:cloudfoundry-identity-server4.13.0 → 4.19.0osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
- Maven org.cloudfoundry.identity:cloudfoundry-identity-server4.8.0 → 4.10.1osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-xh4m-99qp-w483Cloud Foundry UAA open redirect2022-05-14ghsa · osvUS
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (3)
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan