CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2018-15761
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pivotal_software:cloud_foundry_uaa
- pivotal_software:cloudfoundry_uaa_release
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-292x-hjr8-226f | Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | <4.23.0 | 4.23.0 |