FKIE_CVE-2018-11047

Vulnerability from fkie_nvd - Published: 2018-07-24 19:29 - Updated: 2024-11-21 03:42
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.
References
security_alert@emc.comhttps://www.cloudfoundry.org/blog/cve-2018-11047/Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cloudfoundry.org/blog/cve-2018-11047/Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
pivotal_software cloud_foundry_uaa *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "89934957-FA65-4B7C-A5FB-2FF20790C26B",
              "versionEndExcluding": "4.5.7",
              "versionStartIncluding": "4.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEFD0F0C-7C4B-43B3-B3F5-02C3162C473B",
              "versionEndExcluding": "4.7.6",
              "versionStartIncluding": "4.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E64CF7C7-EE86-4A38-AA6A-23B87E3EA453",
              "versionEndExcluding": "4.10.2",
              "versionStartIncluding": "4.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2114BFB-94D6-4F10-8A55-46D4407F5725",
              "versionEndExcluding": "4.12.4",
              "versionStartIncluding": "4.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED93DF45-D18C-4904-854F-CE53337BE912",
              "versionEndExcluding": "4.19.2",
              "versionStartIncluding": "4.19.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid."
    },
    {
      "lang": "es",
      "value": "Cloud Foundry UAA, en versiones 4.19 anteriores a la 4.19.2, versiones 4.12 anteriores a la 4.12.4, versiones 4.10 anteriores a la 4.10.2, versiones 4.7 anteriores a la 4.7.6 y versiones 4.5 anteriores a la 4.5.7, autoriza incorrectamente las peticiones a los endpoints admin aceptando un token de actualizaci\u00f3n v\u00e1lido en lugar de un token de acceso. Por dise\u00f1o, los tokens de actualizaci\u00f3n tienen un tiempo de expiraci\u00f3n mayor que los tokens de acceso, lo que permite que el poseedor de un token de actualizaci\u00f3n se autentique m\u00e1s tiempo del esperado. Esto afecta a los endpoints administrativos de UAA, p.ej., /Users, /Groups, etc. Sin embargo, si el usuario ha sido eliminado o le han eliminado grupos, o si se ha eliminado el cliente, el token de actualizaci\u00f3n ya no ser\u00e1 v\u00e1lido."
    }
  ],
  "id": "CVE-2018-11047",
  "lastModified": "2024-11-21T03:42:33.670",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-07-24T19:29:00.287",
  "references": [
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudfoundry.org/blog/cve-2018-11047/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudfoundry.org/blog/cve-2018-11047/"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.