CVE-2018-1262: UAA privilege escalation across identity zones
Cloud Foundry Foundation
Affected Cloud Foundry Products and Versions
- You are using uaa-release versions v57, v57.1 or v58
- You are using uaa versions 4.12.x or 4.13.x
- You are using cf-deployment versions v1.27.0 through v1.31.0
UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.
Users of affected versions should apply the following mitigations or upgrades:
- Releases that have fixed this issue include:
- uaa-release versions 57.2, 58.1
- uaa versions 4.12.2, 4.13.4
This issue was responsibly reported by the UAA team.
2018-05-14: Initial vulnerability report published.