VDB
CVE-2018-15754
CVE-2018-15754
PUBLISHED
CVSS 4.199999809265137 MEDIUM
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
EPSS 1.78% · 76.1th percentile
Risk Scores
CVSS 3.0
4.199999809265137
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
1.78%
76.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pivotal_software | cloud_foundry_uaa-release | 60.0 |
| Cloud Foundry | UAA Release | 60 |
Timeline
- Dec 13, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Jan 8, 2023 EPSS Score