{"action":"Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 2.7.4.15 (2.7.x), 3.6.9 (3.6.x), 3.9.11 (3.9.x) or 3.16.0 (3.16.x) or later.","affected":[{"fixed":"2.7.4.15","introduced":"2.0.0"},{"fixed":"3.6.9","introduced":"3.0.0"},{"fixed":"3.9.11","introduced":"3.7.0"},{"fixed":"3.16.0","introduced":"3.10.0"}],"component":"org.cloudfoundry.identity:cloudfoundry-identity-server","cve_ids":["CVE-2017-4974"],"ecosystem":"Maven","epss":0.00974,"exploited":false,"fixed_versions":["2.7.4.15","3.6.9","3.9.11","3.16.0"],"ghsa_id":"GHSA-cw9c-v3v2-99hm","id":"tcs_01M5N8TFREQ3ZF0P5F1XKNZ8RY","modified_at":"2024-03-01T20:26:39.471861Z","published_at":"2022-05-13T01:07:26Z","references":["https://osv.dev/vulnerability/GHSA-cw9c-v3v2-99hm","https://nvd.nist.gov/vuln/detail/CVE-2017-4974","https://github.com/cloudfoundry/uaa/commit/01edea6337c8ddb2ab80906aa1254d3c1dc02fb","https://github.com/cloudfoundry/uaa/commit/2dbeb9e93e076d71d7f0886dea9f77f23e0b8f3c","https://github.com/cloudfoundry/uaa/commit/5dc5ca9176ed5baa870680d99f37e7e559dddc5","https://github.com/cloudfoundry/uaa/commit/74b9b270787aa602196d59d58893c3a6e09816f9","https://github.com/cloudfoundry/uaa/commit/b6d6526cb89120043d390bf0274cd062e9fc452","https://github.com/cloudfoundry/uaa","https://web.archive.org/web/20200227163823/http://www.securityfocus.com/bid/99254","https://www.cloudfoundry.org/cve-2017-4974"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cw9c-v3v2-99hm","url":"https://osv.dev/vulnerability/GHSA-cw9c-v3v2-99hm"}],"summary":"Blind SQL Injection with privileged Cloud Foundry UAA endpoints"}