Cloud Foundry Logo
blog single gear
Security Advisory

CVE-2017-4992: Privilege escalation with user invitations

CVE-2017-4992: Privilege escalation with user invitations




Cloud Foundry Foundation

Versions Affected

  • cf-release versions prior to v261
  • UAA release:
    • 2.x versions prior to v2.7.4.17
    • 3.6.x versions prior to v3.6.11
    • 3.9.x versions prior to v3.9.13
    • Other versions prior to v4.2.0
  • UAA bosh release (uaa-release):
    • 13.x versions prior to v13.15
    • 24.x versions prior to v24.10
    • 30.x versions prior to 30.3
    • Other versions prior to v37


Any user or client can access the invitations endpoint to generate a code and perform a password reset for a different  user in the system.


Users of affected versions should apply the following mitigation or upgrade:

  • Upgrade to Cloud Foundry v261 [1] or later
  • For standalone UAA users:
    • For users using UAA Version 3.0.0 – 3.17.0, please upgrade to UAA Release to v3.18.0 [2] or v3.9.13 [3] or v3.6.11 [4]
    • For users using standalone UAA Version 2.X.X, please upgrade to UAA Release to v2.7.4.17 [5]
    • For users using UAA-Release (UAA bosh release), please upgrade to UAA-Release v30.3 [6] if upgrading to v3.18.0 [2] or v24.10 [7] if upgrading to v3.9.13 [3] and v13.15 [8] if upgrading to v3.6.11 [4]
    • For users using the latest version, please upgrade to v37 [9].


This vulnerability was responsibly reported by the GE Digital Security Team.



2017-05-19: Initial vulnerability report published

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR