CVE-2018-11082

9.8 criticalEPSS 1.1%

Critical (9.8) in pivotal software. EPSS 1.1% chance of exploitation in the next 30 days.

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2018-10-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:cloudfoundry_uaa
pivotal_software:cloudfoundry_uaa_release

References

https://www.cloudfoundry.org/blog/cve-2018-11082/
https://www.cloudfoundry.org/blog/cve-2018-11082/

Check your stack JSON