CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations

What is CVE-2017-4992?

CVE-2017-4992 is a critical vulnerability in Cloud Foundry, published on 13 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations.

Weakness: CWE-269

Which versions are affected by CVE-2017-4992?

8 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cf-Release, Cloudfoundry Cloud Foundry Uaa Bosh, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2017-4992?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to a fixed version for your release line: 2.7.4.17, 3.6.11, 4.2.0 or 3.9.13.

Is CVE-2017-4992 being exploited?

There is no known exploitation of CVE-2017-4992 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry

• CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability Critical 9.8
• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6
• CVE-2015-5170 Cloud Foundry Runtime Cross-Site Request Forgery vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jcmh-x32v-7mgf.