CVE-2018-11047
1 advisory.
Maven/org.cloudfoundry.identity:cloudfoundry-identity-server CVE-2018-11047: high 7.5
Cloud Foundry UAA accepts refresh token as access token on admin endpoints
Action: Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 4.5.7 (4.5.x), 4.7.6 (4.7.x), 4.10.2 (4.10.x), 4.12.4 (4.12.x) or 4.19.2 (4.19.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.5.7 | - |
| 4.6.0 | 4.7.6 | - |
| 4.8.0 | 4.10.2 | - |
| 4.11.0 | 4.12.4 | - |
| 4.13.0 | 4.19.2 | - |
Fixed versions
| 4.5.7 | 4.7.6 | 4.10.2 | 4.12.4 | 4.19.2 |
Sources
- osv: GHSA-r4v8-9hgx-vm6m
- https://nvd.nist.gov/vuln/detail/CVE-2018-11047
- https://github.com/cloudfoundry/uaa/commit/0cd3c6fdd96206a1d6a376ac62e21e59e16cdcb1
- https://github.com/cloudfoundry/uaa/commit/2906057dae995024576ce6afdc20abd85569514
- https://github.com/cloudfoundry/uaa/commit/4cb1be404cf4a82e39cf2a6357aa17af8b33f2a1
- https://github.com/cloudfoundry/uaa/commit/4fa3e351ec0bface3b693810605905e29a9a8569
- https://github.com/cloudfoundry/uaa/commit/5d021e83ef143c64179d0da015aa76321ee40988
- https://github.com/cloudfoundry/uaa/commit/81aeb7a3aa048ea086c494f725d643e48dd9266
- https://github.com/cloudfoundry/uaa/commit/a1d523c7f150e56bf06df8b83ed1d416d6c1d3b
- https://github.com/cloudfoundry/uaa/commit/aba1fb5f18e0d628628b2d960fc6d0cc62d86f5
- https://github.com/cloudfoundry/uaa/commit/b37552d2bf084de059bc965b5ef5a45e64883904
- https://github.com/cloudfoundry/uaa/commit/bbbba5aec514ad88e7d1e168a2519c80229f02f
- https://github.com/cloudfoundry/uaa
- https://www.cloudfoundry.org/blog/cve-2018-11047
CVE-2018-11047 · published · modified · JSON