Cloud Foundry Uaa
5 CVEs affecting Cloud Foundry Uaa. Latest disclosed: 2026-06-11. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15761 | Critical | 9.9 | 2018-11-19 | Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A rem… |
CVE-2026-41005 | Critical | 9.0 | 2026-06-11 | Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (a… |
CVE-2020-5402 | High | 8.8 | 2020-02-27 | In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when… |
CVE-2018-11082 | Medium | 6.6 | 2018-10-05 | Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthen… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |