Severity
Medium
Vendor
Cloud Foundry Foundation
Description
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
An attacker can gain access to external IdPs via this leaked secret of UAA server.
Affected Cloud Foundry Products and Versions
Severity is medium unless otherwise noted.
- UAA Release
- All versions prior to 75.3.0
- CF Deployment
- All versions prior to 16.18.0
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- UAA Release
- Upgrade all versions to 75.3.0 or greater
- CF Deployment
- Upgrade all versions to 16.18.0 or greater
Credit
This issue was responsibly reported by Klaus Kiefer from SAP.
History
2021-07-22: Initial vulnerability report published.
