CVE-2018-15761

moderate-risk
Published 2018-11-19

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.

Do I need to act?

-
0.53% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 206e2a3a8a08bf89cf46a0c65ed43bf0514b1826, f34df0ec7b065d4f9de2c952e117df1b7f1134b8
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Cloudfoundry Uaa Release

Affected Vendors

Pivotal Software

References (2)

Vendor Advisory https://www.cloudfoundry.org/blog/cve-2018-15761/
Vendor Advisory https://www.cloudfoundry.org/blog/cve-2018-15761/
42
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 2/34 · Minimal
Exposure 7/34 · Low