Vulnerability Description
Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Cloud Foundry Uaa | >= 4.5.0, < 4.5.7 |
Related Weaknesses (CWE)
References
- https://www.cloudfoundry.org/blog/cve-2018-11047/MitigationVendor Advisory
- https://www.cloudfoundry.org/blog/cve-2018-11047/MitigationVendor Advisory
FAQ
What is CVE-2018-11047?
CVE-2018-11047 is a vulnerability with a CVSS score of 7.5 (HIGH). Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by ...
How severe is CVE-2018-11047?
CVE-2018-11047 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-11047?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Cloud Foundry Uaa.