CVE-2017-4974
1 advisory.
Maven/org.cloudfoundry.identity:cloudfoundry-identity-server CVE-2017-4974: medium 6.5
Blind SQL Injection with privileged Cloud Foundry UAA endpoints
Action: Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 2.7.4.15 (2.7.x), 3.6.9 (3.6.x), 3.9.11 (3.9.x) or 3.16.0 (3.16.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.7.4.15 | - |
| 3.0.0 | 3.6.9 | - |
| 3.7.0 | 3.9.11 | - |
| 3.10.0 | 3.16.0 | - |
Fixed versions
| 2.7.4.15 | 3.6.9 | 3.9.11 | 3.16.0 |
Sources
- osv: GHSA-cw9c-v3v2-99hm
- https://nvd.nist.gov/vuln/detail/CVE-2017-4974
- https://github.com/cloudfoundry/uaa/commit/01edea6337c8ddb2ab80906aa1254d3c1dc02fb
- https://github.com/cloudfoundry/uaa/commit/2dbeb9e93e076d71d7f0886dea9f77f23e0b8f3c
- https://github.com/cloudfoundry/uaa/commit/5dc5ca9176ed5baa870680d99f37e7e559dddc5
- https://github.com/cloudfoundry/uaa/commit/74b9b270787aa602196d59d58893c3a6e09816f9
- https://github.com/cloudfoundry/uaa/commit/b6d6526cb89120043d390bf0274cd062e9fc452
- https://github.com/cloudfoundry/uaa
- https://web.archive.org/web/20200227163823/http://www.securityfocus.com/bid/99254
- https://www.cloudfoundry.org/cve-2017-4974
CVE-2017-4974 · published · modified · JSON