SB2018062516 - Open redirect in Cloud Foundry UAA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018062516

SB2018062516 - Open redirect in Cloud Foundry UAA

Published: June 25, 2018 Updated: August 8, 2020

Security Bulletin ID SB2018062516
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Open redirect (CVE-ID: CVE-2018-11041)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.


Remediation

Install update from vendor's website.

References