CVE-2018-11047
First published: Tue Jul 24 2018(Updated: )
Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.
Credit: security_alert@emc.com security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Software Cloud Foundry Uaa | >=4.5.0<4.5.7 | |
| Pivotal Software Cloud Foundry Uaa | >=4.7.0<4.7.6 | |
| Pivotal Software Cloud Foundry Uaa | >=4.10.0<4.10.2 | |
| Pivotal Software Cloud Foundry Uaa | >=4.12.0<4.12.4 | |
| Pivotal Software Cloud Foundry Uaa | >=4.19.0<4.19.2 | |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=4.13.0<4.19.2 | 4.19.2 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=4.11.0<4.12.4 | 4.12.4 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=4.8.0<4.10.2 | 4.10.2 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=4.6.0<4.7.6 | 4.7.6 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | <4.5.7 | 4.5.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cloudfoundry.org/blog/cve-2018-11047/
- https://nvd.nist.gov/vuln/detail/CVE-2018-11047
- https://github.com/cloudfoundry/uaa/commit/0cd3c6fdd96206a1d6a376ac62e21e59e16cdcb1
- https://github.com/cloudfoundry/uaa/commit/2906057dae995024576ce6afdc20abd85569514
- https://github.com/cloudfoundry/uaa/commit/4cb1be404cf4a82e39cf2a6357aa17af8b33f2a1
- https://github.com/cloudfoundry/uaa/commit/4fa3e351ec0bface3b693810605905e29a9a8569
- https://github.com/cloudfoundry/uaa/commit/5d021e83ef143c64179d0da015aa76321ee40988
- https://github.com/cloudfoundry/uaa/commit/81aeb7a3aa048ea086c494f725d643e48dd9266
- https://github.com/cloudfoundry/uaa/commit/a1d523c7f150e56bf06df8b83ed1d416d6c1d3b
- https://github.com/cloudfoundry/uaa/commit/aba1fb5f18e0d628628b2d960fc6d0cc62d86f5
- https://github.com/cloudfoundry/uaa/commit/b37552d2bf084de059bc965b5ef5a45e64883904
- https://github.com/cloudfoundry/uaa/commit/bbbba5aec514ad88e7d1e168a2519c80229f02f
- https://www.cloudfoundry.org/blog/cve-2018-11047
- https://github.com/advisories/GHSA-r4v8-9hgx-vm6m (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-11047.
What software versions are affected by this vulnerability?
The affected software versions are Cloud Foundry UAA versions 4.19 prior to 4.19.2, 4.12 prior to 4.12.4, 4.10 prior to 4.10.2, 4.7 prior to 4.7.6, and 4.5 prior to 4.5.7.
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is high with a score of 7.5.
How does this vulnerability impact Cloud Foundry UAA?
This vulnerability allows attackers to authorize requests to admin endpoints by using a valid refresh token instead of an access token.
How can I fix this vulnerability?
To fix this vulnerability, update your Cloud Foundry UAA installation to version 4.19.2, 4.12.4, 4.10.2, 4.7.6, or 4.5.7.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r4v8-9hgx-vm6m
- alias/CVE-2018-11047
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pivotal software
- canonical/pivotal software cloud foundry uaa
- version/pivotal software cloud foundry uaa/4.5.0
- version/pivotal software cloud foundry uaa/4.7.0
- version/pivotal software cloud foundry uaa/4.10.0
- version/pivotal software cloud foundry uaa/4.12.0
- version/pivotal software cloud foundry uaa/4.19.0
- package-manager/maven