PT-2018-13182
CVE-2018-15754
·
تاريخ النشر
2018-12-13
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Cloud Foundry UAA versions prior to 66.0
Description
The issue concerns an authorization logic error in environments with multiple identity providers where accounts have the same username across different providers. A remote authenticated user with access to one account may be able to obtain a token for an account with the same username in another identity provider.
Recommendations
For versions prior to 66.0, update to version 66.0 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾