CVE-2017-4973
First published: Tue Jun 13 2017(Updated: )
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. A vulnerability has been identified with the groups endpoint in UAA allowing users to elevate their privileges.
Credit: security_alert@emc.com security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cloudfoundry Cloud Foundry Uaa Bosh | <=30 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.1 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.2 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.3 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.4 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.5 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.6 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.7 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.8 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.9 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.10 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =13.11 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24.1 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24.2 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24.3 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24.4 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24.5 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =24.6 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =30.1 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =30.2 | |
| Cloudfoundry Cloud Foundry Uaa Bosh | =30.3 | |
| Pivotal Software Cloud Foundry Cf | <=256 | |
| Pivotal Software Cloud Foundry Uaa | =2.2.5.4 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.1 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.2 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.3 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.1 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.2 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.3 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.4 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.5 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.6 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.7 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.8 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.9 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.11 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.12 | |
| Pivotal Software Cloud Foundry Uaa | =2.7.4.13 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.1 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.2 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.3 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.4 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.5 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.6 | |
| Pivotal Software Cloud Foundry Uaa | =3.6.7 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.1 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.2 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.3 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.4 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.5 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.6 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.7 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.8 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.9 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.12 | |
| Pivotal Software Cloud Foundry Uaa | =3.9.13 | |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.10.0<3.15.0 | 3.15.0 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.7.0<3.9.10 | 3.9.10 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.0.0<3.6.8 | 3.6.8 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=2.0.0<2.7.4.14 | 2.7.4.14 |
| <=30 | ||
| =13.1 | ||
| =13.2 | ||
| =13.3 | ||
| =13.4 | ||
| =13.5 | ||
| =13.6 | ||
| =13.7 | ||
| =13.8 | ||
| =13.9 | ||
| =13.10 | ||
| =13.11 | ||
| =24 | ||
| =24.1 | ||
| =24.2 | ||
| =24.3 | ||
| =24.4 | ||
| =24.5 | ||
| =24.6 | ||
| =30.1 | ||
| =30.2 | ||
| =30.3 | ||
| <=256 | ||
| =2.2.5.4 | ||
| =2.7.1 | ||
| =2.7.2 | ||
| =2.7.3 | ||
| =2.7.4 | ||
| =2.7.4.1 | ||
| =2.7.4.2 | ||
| =2.7.4.3 | ||
| =2.7.4.4 | ||
| =2.7.4.5 | ||
| =2.7.4.6 | ||
| =2.7.4.7 | ||
| =2.7.4.8 | ||
| =2.7.4.9 | ||
| =2.7.4.11 | ||
| =2.7.4.12 | ||
| =2.7.4.13 | ||
| =3.6.1 | ||
| =3.6.2 | ||
| =3.6.3 | ||
| =3.6.4 | ||
| =3.6.5 | ||
| =3.6.6 | ||
| =3.6.7 | ||
| =3.9.1 | ||
| =3.9.2 | ||
| =3.9.3 | ||
| =3.9.4 | ||
| =3.9.5 | ||
| =3.9.6 | ||
| =3.9.7 | ||
| =3.9.8 | ||
| =3.9.9 | ||
| =3.9.12 | ||
| =3.9.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cloudfoundry.org/cve-2017-4973/
- https://nvd.nist.gov/vuln/detail/CVE-2017-4973
- https://github.com/cloudfoundry/uaa/commit/0762cc768592abc4fb1c6afd9974ea6fb964f0f2
- https://github.com/cloudfoundry/uaa/commit/18cf22ba9177f1124f85f99651b474b48f12cd28
- https://github.com/cloudfoundry/uaa/commit/24bc5ade80560cedb9300940d2b398163ab0dc6
- https://github.com/cloudfoundry/uaa/commit/24c270ce725df890727b2bd7d8a4f338a3a58b7
- https://github.com/cloudfoundry/uaa/commit/3c456f0285e92713a0a9ce54c3e57d8636b9183c
- https://github.com/cloudfoundry/uaa/commit/52acfabd11c3c77c2a3f5229b32f56de0e8d26ad
- https://github.com/cloudfoundry/uaa/commit/5eb43757d5a3a2c9e7aae1ef3d0b9b7e2a38851e
- https://github.com/cloudfoundry/uaa/commit/9d44cb0c7c25ccae95bfa1c2d59ce46200c643cb
- https://www.cloudfoundry.org/cve-2017-4973
- https://github.com/advisories/GHSA-pgjc-gc7g-p2c6 (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pgjc-gc7g-p2c6
- alias/CVE-2017-4973
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/description
- agent/author
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/cloudfoundry
- canonical/cloudfoundry cloud foundry uaa bosh
- version/cloudfoundry cloud foundry uaa bosh/30
- version/cloudfoundry cloud foundry uaa bosh/13.1
- version/cloudfoundry cloud foundry uaa bosh/13.2
- version/cloudfoundry cloud foundry uaa bosh/13.3
- version/cloudfoundry cloud foundry uaa bosh/13.4
- version/cloudfoundry cloud foundry uaa bosh/13.5
- version/cloudfoundry cloud foundry uaa bosh/13.6
- version/cloudfoundry cloud foundry uaa bosh/13.7
- version/cloudfoundry cloud foundry uaa bosh/13.8
- version/cloudfoundry cloud foundry uaa bosh/13.9
- version/cloudfoundry cloud foundry uaa bosh/13.10
- version/cloudfoundry cloud foundry uaa bosh/13.11
- version/cloudfoundry cloud foundry uaa bosh/24
- version/cloudfoundry cloud foundry uaa bosh/24.1
- version/cloudfoundry cloud foundry uaa bosh/24.2
- version/cloudfoundry cloud foundry uaa bosh/24.3
- version/cloudfoundry cloud foundry uaa bosh/24.4
- version/cloudfoundry cloud foundry uaa bosh/24.5
- version/cloudfoundry cloud foundry uaa bosh/24.6
- version/cloudfoundry cloud foundry uaa bosh/30.1
- version/cloudfoundry cloud foundry uaa bosh/30.2
- version/cloudfoundry cloud foundry uaa bosh/30.3
- vendor/pivotal software
- canonical/pivotal software cloud foundry cf
- version/pivotal software cloud foundry cf/256
- canonical/pivotal software cloud foundry uaa
- version/pivotal software cloud foundry uaa/2.2.5.4
- version/pivotal software cloud foundry uaa/2.7.1
- version/pivotal software cloud foundry uaa/2.7.2
- version/pivotal software cloud foundry uaa/2.7.3
- version/pivotal software cloud foundry uaa/2.7.4
- version/pivotal software cloud foundry uaa/2.7.4.1
- version/pivotal software cloud foundry uaa/2.7.4.2
- version/pivotal software cloud foundry uaa/2.7.4.3
- version/pivotal software cloud foundry uaa/2.7.4.4
- version/pivotal software cloud foundry uaa/2.7.4.5
- version/pivotal software cloud foundry uaa/2.7.4.6
- version/pivotal software cloud foundry uaa/2.7.4.7
- version/pivotal software cloud foundry uaa/2.7.4.8
- version/pivotal software cloud foundry uaa/2.7.4.9
- version/pivotal software cloud foundry uaa/2.7.4.11
- version/pivotal software cloud foundry uaa/2.7.4.12
- version/pivotal software cloud foundry uaa/2.7.4.13
- version/pivotal software cloud foundry uaa/3.6.1
- version/pivotal software cloud foundry uaa/3.6.2
- version/pivotal software cloud foundry uaa/3.6.3
- version/pivotal software cloud foundry uaa/3.6.4
- version/pivotal software cloud foundry uaa/3.6.5
- version/pivotal software cloud foundry uaa/3.6.6
- version/pivotal software cloud foundry uaa/3.6.7
- version/pivotal software cloud foundry uaa/3.9.1
- version/pivotal software cloud foundry uaa/3.9.2
- version/pivotal software cloud foundry uaa/3.9.3
- version/pivotal software cloud foundry uaa/3.9.4
- version/pivotal software cloud foundry uaa/3.9.5
- version/pivotal software cloud foundry uaa/3.9.6
- version/pivotal software cloud foundry uaa/3.9.7
- version/pivotal software cloud foundry uaa/3.9.8
- version/pivotal software cloud foundry uaa/3.9.9
- version/pivotal software cloud foundry uaa/3.9.12
- version/pivotal software cloud foundry uaa/3.9.13
- package-manager/maven