8.1
CVE-2017-4963
- EPSS 0.39%
- Published 13.06.2017 06:29:00
- Last modified 20.04.2025 01:37:25
- Source security_alert@emc.com
- Teams watchlist Login
- Open Login
An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.
Data is provided by the National Vulnerability Database (NVD)
Pivotal Software ≫ Cloud Foundry Cf-release Version <= 252
Pivotal Software ≫ Cloud Foundry Uaa Version >= 2.0.0 <= 2.7.4.12
Pivotal Software ≫ Cloud Foundry Uaa Version >= 3.0.0 <= 3.11.0
Pivotal Software ≫ Cloud Foundry Uaa-release SwPlatformbosh Version <= 26
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.39% | 0.569 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.1 | 2.2 | 5.9 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-384 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.