CVE-2018-11047— Cloud Foundry UAA 安全漏洞

N/A

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.

N/A

N/A

Cloud Foundry UAA 安全漏洞

Cloud Foundry UAA是美国Cloud Foundry基金会的应用于Cloud Foundry云平台的一款身份验证和管理服务终端。 Cloud Foundry UAA中存在安全漏洞。攻击者可利用该漏洞绕过访问限制。以下版本受到影响：Cloud Foundry UAA 4.19.2之前的4.19版本，4.12.4之前的4.12版本，4.10.2之前的4.10版本，4.7.6之前的4.7版本，4.5.7之前的4.5版本。

N/A

N/A