CVE-2017-4991 Cloud Foundry UAA password reset vulnerability

What is CVE-2017-4991?

CVE-2017-4991 is a high-severity vulnerability in Cloud Foundry UAA, published on 13 Jun 2017. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.

Weakness: CWE-269

Which versions are affected by CVE-2017-4991?

8 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cf-Release, Cloudfoundry Cloud Foundry Uaa Bosh, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2017-4991?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to a fixed version for your release line: 2.7.4.16, 3.6.10, 3.17.0 or 3.9.12.

Is CVE-2017-4991 being exploited?

There is no known exploitation of CVE-2017-4991 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry UAA

• CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability Critical 9.8
• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cgrg-x34r-78f3.