Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-4992

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations.

Published

2017-06-13T06:29:00.770

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-269
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cloudfoundry cf-release ≤ 260 Yes
Application cloudfoundry cloud_foundry_uaa_bosh ≤ 27 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.1 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.2 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.3 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.4 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.5 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.6 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.7 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.8 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.9 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.10 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.11 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.12 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.13 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 13.14 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.1 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.2 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.3 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.4 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.5 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.6 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.7 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.8 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 24.9 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 30 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 30.1 Yes
Application cloudfoundry cloud_foundry_uaa_bosh 30.2 Yes
Application pivotal_software cloud_foundry_uaa ≤ 4.2.0 Yes
Application pivotal_software cloud_foundry_uaa 2.2.5.4 Yes
Application pivotal_software cloud_foundry_uaa 2.7.1 Yes
Application pivotal_software cloud_foundry_uaa 2.7.2 Yes
Application pivotal_software cloud_foundry_uaa 2.7.3 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.1 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.2 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.3 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.4 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.5 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.6 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.7 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.8 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.9 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.11 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.12 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.13 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.14 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.15 Yes
Application pivotal_software cloud_foundry_uaa 2.7.4.16 Yes
Application pivotal_software cloud_foundry_uaa 3.6.1 Yes
Application pivotal_software cloud_foundry_uaa 3.6.2 Yes
Application pivotal_software cloud_foundry_uaa 3.6.3 Yes
Application pivotal_software cloud_foundry_uaa 3.6.4 Yes
Application pivotal_software cloud_foundry_uaa 3.6.5 Yes
Application pivotal_software cloud_foundry_uaa 3.6.6 Yes
Application pivotal_software cloud_foundry_uaa 3.6.7 Yes
Application pivotal_software cloud_foundry_uaa 3.6.8 Yes
Application pivotal_software cloud_foundry_uaa 3.6.9 Yes
Application pivotal_software cloud_foundry_uaa 3.6.10 Yes
Application pivotal_software cloud_foundry_uaa 3.9.1 Yes
Application pivotal_software cloud_foundry_uaa 3.9.2 Yes
Application pivotal_software cloud_foundry_uaa 3.9.3 Yes
Application pivotal_software cloud_foundry_uaa 3.9.4 Yes
Application pivotal_software cloud_foundry_uaa 3.9.5 Yes
Application pivotal_software cloud_foundry_uaa 3.9.6 Yes
Application pivotal_software cloud_foundry_uaa 3.9.7 Yes
Application pivotal_software cloud_foundry_uaa 3.9.8 Yes
Application pivotal_software cloud_foundry_uaa 3.9.9 Yes
Application pivotal_software cloud_foundry_uaa 3.9.10 Yes
Application pivotal_software cloud_foundry_uaa 3.9.11 Yes
Application pivotal_software cloud_foundry_uaa 3.9.12 Yes
Application pivotal_software cloud_foundry_uaa 3.9.13 Yes
References