What is CVE-2024-38806?

CVE-2024-38806 is a low-severity vulnerability in Uaa, classified under Expected Behavior Violation. CVSS score: 3.9/10. Published 2024-07-18.

How severe is CVE-2024-38806?

Low severity. CVSS v3 base score is 3.9 out of 10.

Vulnerability in Uaa

CVE-2024-38806

Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their intended permissions.

EPSS: 0.001 (3.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L.

Affected products

N/a Uaa — versions v77.10.0 and below

Weakness classification (CWE)

CWE-440 — Expected Behavior Violation

References

security@vmware.com

Frequently asked questions

What is CVE-2024-38806?: CVE-2024-38806 is a low-severity vulnerability in Uaa, classified under Expected Behavior Violation. CVSS score: 3.9/10. Published 2024-07-18.
How severe is CVE-2024-38806?: Low severity. CVSS v3 base score is 3.9 out of 10.