CVE-2017-4973
First published: Tue Jun 13 2017(Updated: )
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. A vulnerability has been identified with the groups endpoint in UAA allowing users to elevate their privileges.
Credit: security_alert@emc.com security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.10.0<3.15.0 | 3.15.0 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.7.0<3.9.10 | 3.9.10 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.0.0<3.6.8 | 3.6.8 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=2.0.0<2.7.4.14 | 2.7.4.14 |
| Cloud Foundry UAA | <=30 | |
| Cloud Foundry UAA | =13.1 | |
| Cloud Foundry UAA | =13.2 | |
| Cloud Foundry UAA | =13.3 | |
| Cloud Foundry UAA | =13.4 | |
| Cloud Foundry UAA | =13.5 | |
| Cloud Foundry UAA | =13.6 | |
| Cloud Foundry UAA | =13.7 | |
| Cloud Foundry UAA | =13.8 | |
| Cloud Foundry UAA | =13.9 | |
| Cloud Foundry UAA | =13.10 | |
| Cloud Foundry UAA | =13.11 | |
| Cloud Foundry UAA | =24 | |
| Cloud Foundry UAA | =24.1 | |
| Cloud Foundry UAA | =24.2 | |
| Cloud Foundry UAA | =24.3 | |
| Cloud Foundry UAA | =24.4 | |
| Cloud Foundry UAA | =24.5 | |
| Cloud Foundry UAA | =24.6 | |
| Cloud Foundry UAA | =30.1 | |
| Cloud Foundry UAA | =30.2 | |
| Cloud Foundry UAA | =30.3 | |
| Cloud Foundry Cf-networking | <=256 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.2.5.4 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.1 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.2 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.3 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.1 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.2 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.3 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.4 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.5 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.6 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.7 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.8 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.9 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.11 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.12 | |
| Cloud Foundry User Account and Authentication (UAA) | =2.7.4.13 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.1 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.2 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.3 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.4 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.5 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.6 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.6.7 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.1 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.2 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.3 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.4 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.5 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.6 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.7 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.8 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.9 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.12 | |
| Cloud Foundry User Account and Authentication (UAA) | =3.9.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cloudfoundry.org/cve-2017-4973/
- https://nvd.nist.gov/vuln/detail/CVE-2017-4973
- https://github.com/cloudfoundry/uaa/commit/0762cc768592abc4fb1c6afd9974ea6fb964f0f2
- https://github.com/cloudfoundry/uaa/commit/18cf22ba9177f1124f85f99651b474b48f12cd28
- https://github.com/cloudfoundry/uaa/commit/24bc5ade80560cedb9300940d2b398163ab0dc6
- https://github.com/cloudfoundry/uaa/commit/24c270ce725df890727b2bd7d8a4f338a3a58b7
- https://github.com/cloudfoundry/uaa/commit/3c456f0285e92713a0a9ce54c3e57d8636b9183c
- https://github.com/cloudfoundry/uaa/commit/52acfabd11c3c77c2a3f5229b32f56de0e8d26ad
- https://github.com/cloudfoundry/uaa/commit/5eb43757d5a3a2c9e7aae1ef3d0b9b7e2a38851e
- https://github.com/cloudfoundry/uaa/commit/9d44cb0c7c25ccae95bfa1c2d59ce46200c643cb
- https://www.cloudfoundry.org/cve-2017-4973
- https://github.com/advisories/GHSA-pgjc-gc7g-p2c6 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2017-4973?
CVE-2017-4973 has been classified as a medium severity vulnerability.
How do I fix CVE-2017-4973?
To fix CVE-2017-4973, update to Cloud Foundry UAA release versions 2.7.4.14, 3.6.8, 3.9.10, or 3.15.0, or higher.
What software is affected by CVE-2017-4973?
CVE-2017-4973 affects versions of Cloud Foundry Foundation cf-release prior to v257 and UAA releases noted in the description.
Is CVE-2017-4973 exploitable remotely?
Yes, CVE-2017-4973 can be exploited remotely under specific conditions.
Are there known workarounds for CVE-2017-4973?
There are no documented workarounds for CVE-2017-4973; updating to a patched version is the recommended mitigation.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pgjc-gc7g-p2c6
- alias/CVE-2017-4973
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/maven
- vendor/cloudfoundry
- canonical/cloud foundry uaa
- version/cloud foundry uaa/30
- version/cloud foundry uaa/13.1
- version/cloud foundry uaa/13.2
- version/cloud foundry uaa/13.3
- version/cloud foundry uaa/13.4
- version/cloud foundry uaa/13.5
- version/cloud foundry uaa/13.6
- version/cloud foundry uaa/13.7
- version/cloud foundry uaa/13.8
- version/cloud foundry uaa/13.9
- version/cloud foundry uaa/13.10
- version/cloud foundry uaa/13.11
- version/cloud foundry uaa/24
- version/cloud foundry uaa/24.1
- version/cloud foundry uaa/24.2
- version/cloud foundry uaa/24.3
- version/cloud foundry uaa/24.4
- version/cloud foundry uaa/24.5
- version/cloud foundry uaa/24.6
- version/cloud foundry uaa/30.1
- version/cloud foundry uaa/30.2
- version/cloud foundry uaa/30.3
- vendor/pivotal software
- canonical/cloud foundry cf-networking
- version/cloud foundry cf-networking/256
- canonical/cloud foundry user account and authentication (uaa)
- version/cloud foundry user account and authentication (uaa)/2.2.5.4
- version/cloud foundry user account and authentication (uaa)/2.7.1
- version/cloud foundry user account and authentication (uaa)/2.7.2
- version/cloud foundry user account and authentication (uaa)/2.7.3
- version/cloud foundry user account and authentication (uaa)/2.7.4
- version/cloud foundry user account and authentication (uaa)/2.7.4.1
- version/cloud foundry user account and authentication (uaa)/2.7.4.2
- version/cloud foundry user account and authentication (uaa)/2.7.4.3
- version/cloud foundry user account and authentication (uaa)/2.7.4.4
- version/cloud foundry user account and authentication (uaa)/2.7.4.5
- version/cloud foundry user account and authentication (uaa)/2.7.4.6
- version/cloud foundry user account and authentication (uaa)/2.7.4.7
- version/cloud foundry user account and authentication (uaa)/2.7.4.8
- version/cloud foundry user account and authentication (uaa)/2.7.4.9
- version/cloud foundry user account and authentication (uaa)/2.7.4.11
- version/cloud foundry user account and authentication (uaa)/2.7.4.12
- version/cloud foundry user account and authentication (uaa)/2.7.4.13
- version/cloud foundry user account and authentication (uaa)/3.6.1
- version/cloud foundry user account and authentication (uaa)/3.6.2
- version/cloud foundry user account and authentication (uaa)/3.6.3
- version/cloud foundry user account and authentication (uaa)/3.6.4
- version/cloud foundry user account and authentication (uaa)/3.6.5
- version/cloud foundry user account and authentication (uaa)/3.6.6
- version/cloud foundry user account and authentication (uaa)/3.6.7
- version/cloud foundry user account and authentication (uaa)/3.9.1
- version/cloud foundry user account and authentication (uaa)/3.9.2
- version/cloud foundry user account and authentication (uaa)/3.9.3
- version/cloud foundry user account and authentication (uaa)/3.9.4
- version/cloud foundry user account and authentication (uaa)/3.9.5
- version/cloud foundry user account and authentication (uaa)/3.9.6
- version/cloud foundry user account and authentication (uaa)/3.9.7
- version/cloud foundry user account and authentication (uaa)/3.9.8
- version/cloud foundry user account and authentication (uaa)/3.9.9
- version/cloud foundry user account and authentication (uaa)/3.9.12
- version/cloud foundry user account and authentication (uaa)/3.9.13