org.cloudfoundry.identity:cloudfoundry-identity-server (Maven)
Advisories
53
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 78.8.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.cloudfoundry.identity</groupId><artifactId>cloudfoundry-identity-server</artifactId><version>78.8.0</version></dependency>gradle
implementation("org.cloudfoundry.identity:cloudfoundry-identity-server:78.8.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6wcw-r64p-qrrw Cloudfoundry UAA has logic error in the token revocation endpoint implementation |
Medium EPSS 0.26% |
>= 77.30.0, < 78.8.0 | 78.8.0 |
| GHSA-xg5v-696h-c3vr Cloud Foundry UAA SessionID present in Audit Event Logs |
High EPSS 1.01% |
>= 4.8.0, < 4.8.3 | 4.8.3 |
| GHSA-xg5v-696h-c3vr Cloud Foundry UAA SessionID present in Audit Event Logs |
High EPSS 1.01% |
< 4.5.5 | 4.5.5 |
| GHSA-xg5v-696h-c3vr Cloud Foundry UAA SessionID present in Audit Event Logs |
High EPSS 1.01% |
>= 4.6.0, < 4.7.4 | 4.7.4 |
| GHSA-xh4m-99qp-w483 Cloud Foundry UAA open redirect |
Medium EPSS 0.85% |
>= 4.13.0, < 4.19.0 | 4.19.0 |
| GHSA-xh4m-99qp-w483 Cloud Foundry UAA open redirect |
Medium EPSS 0.85% |
< 4.7.5 | 4.7.5 |
| GHSA-xh4m-99qp-w483 Cloud Foundry UAA open redirect |
Medium EPSS 0.85% |
>= 4.8.0, < 4.10.1 | 4.10.1 |
| GHSA-xh4m-99qp-w483 Cloud Foundry UAA open redirect |
Medium EPSS 0.85% |
>= 4.11.0, < 4.12.3 | 4.12.3 |
| GHSA-rc2r-w8jv-vggp Cloud Foundry vulnerable to Improper Certificate Validation |
Medium EPSS 1.03% |
>= 3.4.0, < 3.4.2 | 3.4.2 |
| GHSA-rc2r-w8jv-vggp Cloud Foundry vulnerable to Improper Certificate Validation |
Medium EPSS 1.03% |
>= 3.0.0, < 3.3.0.3 | 3.3.0.3 |
| GHSA-r4v8-9hgx-vm6m Cloud Foundry UAA accepts refresh token as access token on admin endpoints |
High EPSS 1.07% |
>= 4.13.0, < 4.19.2 | 4.19.2 |
| GHSA-r4v8-9hgx-vm6m Cloud Foundry UAA accepts refresh token as access token on admin endpoints |
High EPSS 1.07% |
>= 4.11.0, < 4.12.4 | 4.12.4 |
| GHSA-r4v8-9hgx-vm6m Cloud Foundry UAA accepts refresh token as access token on admin endpoints |
High EPSS 1.07% |
>= 4.8.0, < 4.10.2 | 4.10.2 |
| GHSA-r4v8-9hgx-vm6m Cloud Foundry UAA accepts refresh token as access token on admin endpoints |
High EPSS 1.07% |
>= 4.6.0, < 4.7.6 | 4.7.6 |
| GHSA-r4v8-9hgx-vm6m Cloud Foundry UAA accepts refresh token as access token on admin endpoints |
High EPSS 1.07% |
< 4.5.7 | 4.5.7 |
| GHSA-292x-hjr8-226f Cloud Foundry UAA Privilege Escalation |
High EPSS 1.71% |
< 4.23.0 | 4.23.0 |
| GHSA-j97q-9xp9-g5fx Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint |
Medium EPSS 0.83% |
>= 3.0.0, < 3.20.2 | 3.20.2 |
| GHSA-j4p3-2m2h-cv5f Cloud Foundry UAA Denial of Service through client token revocation endpoint |
Medium EPSS 1.09% |
>= 4.6.0, < 4.7.1 | 4.7.1 |
| GHSA-j4p3-2m2h-cv5f Cloud Foundry UAA Denial of Service through client token revocation endpoint |
Medium EPSS 1.09% |
>= 4.0.0, < 4.5.3 | 4.5.3 |
| GHSA-j4p3-2m2h-cv5f Cloud Foundry UAA Denial of Service through client token revocation endpoint |
Medium EPSS 1.09% |
< 3.20.1 | 3.20.1 |
| GHSA-4m8c-h7fr-gq5c Cloud Foundry vulnerable to Cross-Site Request Forgery |
Critical EPSS 0.73% |
>= 3.4.0, < 3.4.4 | 3.4.4 |
| GHSA-9frw-wmvq-5rrc Cloud Foundry UAA Identity Zone Admin Privilege Escalation |
Medium EPSS 0.88% |
>= 3.7.0, < 3.9.15 | 3.9.15 |
| GHSA-9frw-wmvq-5rrc Cloud Foundry UAA Identity Zone Admin Privilege Escalation |
Medium EPSS 0.88% |
< 3.6.13 | 3.6.13 |
| GHSA-9frw-wmvq-5rrc Cloud Foundry UAA Identity Zone Admin Privilege Escalation |
Medium EPSS 0.88% |
>= 3.10.0, < 3.20.0 | 3.20.0 |
| GHSA-4m8c-h7fr-gq5c Cloud Foundry vulnerable to Cross-Site Request Forgery |
Critical EPSS 0.73% |
>= 3.5.0, < 3.7.0 | 3.7.0 |
| GHSA-4m8c-h7fr-gq5c Cloud Foundry vulnerable to Cross-Site Request Forgery |
Critical EPSS 0.73% |
>= 3.0.0, < 3.3.0.5 | 3.3.0.5 |
| GHSA-4m8c-h7fr-gq5c Cloud Foundry vulnerable to Cross-Site Request Forgery |
Critical EPSS 0.73% |
>= 2.0.0, < 2.7.4.7 | 2.7.4.7 |
| GHSA-9frw-wmvq-5rrc Cloud Foundry UAA Identity Zone Admin Privilege Escalation |
Medium EPSS 0.88% |
>= 4.0.0, < 4.4.0 | 4.4.0 |
| GHSA-cgrg-x34r-78f3 Cloud Foundry UAA password reset vulnerability |
High EPSS 0.94% |
>= 2.0.0, < 2.7.4.16 | 2.7.4.16 |
| GHSA-cgrg-x34r-78f3 Cloud Foundry UAA password reset vulnerability |
High EPSS 0.94% |
>= 3.0.0, < 3.6.10 | 3.6.10 |
| GHSA-cgrg-x34r-78f3 Cloud Foundry UAA password reset vulnerability |
High EPSS 0.94% |
>= 3.7.0, < 3.9.12 | 3.9.12 |
| GHSA-cgrg-x34r-78f3 Cloud Foundry UAA password reset vulnerability |
High EPSS 0.94% |
>= 3.10.0, < 3.17.0 | 3.17.0 |
| GHSA-cw9c-v3v2-99hm Blind SQL Injection with privileged Cloud Foundry UAA endpoints |
Medium EPSS 0.97% |
>= 2.0.0, < 2.7.4.15 | 2.7.4.15 |
| GHSA-cw9c-v3v2-99hm Blind SQL Injection with privileged Cloud Foundry UAA endpoints |
Medium EPSS 0.97% |
>= 3.0.0, < 3.6.9 | 3.6.9 |
| GHSA-cw9c-v3v2-99hm Blind SQL Injection with privileged Cloud Foundry UAA endpoints |
Medium EPSS 0.97% |
>= 3.7.0, < 3.9.11 | 3.9.11 |
| GHSA-cw9c-v3v2-99hm Blind SQL Injection with privileged Cloud Foundry UAA endpoints |
Medium EPSS 0.97% |
>= 3.10.0, < 3.16.0 | 3.16.0 |
| GHSA-pgjc-gc7g-p2c6 Cloud Foundry UAA Privilege Escalation |
High EPSS 1.07% |
>= 3.7.0, < 3.9.10 | 3.9.10 |
| GHSA-pgjc-gc7g-p2c6 Cloud Foundry UAA Privilege Escalation |
High EPSS 1.07% |
>= 3.10.0, < 3.15.0 | 3.15.0 |
| GHSA-pgjc-gc7g-p2c6 Cloud Foundry UAA Privilege Escalation |
High EPSS 1.07% |
>= 3.0.0, < 3.6.8 | 3.6.8 |
| GHSA-pgjc-gc7g-p2c6 Cloud Foundry UAA Privilege Escalation |
High EPSS 1.07% |
>= 2.0.0, < 2.7.4.14 | 2.7.4.14 |
| GHSA-jcmh-x32v-7mgf Cloud Foundry UAA privilege escalation with user invitations |
Critical EPSS 1.17% |
>= 3.10.0, < 4.2.0 | 4.2.0 |
| GHSA-jcmh-x32v-7mgf Cloud Foundry UAA privilege escalation with user invitations |
Critical EPSS 1.17% |
>= 3.7.0, < 3.9.13 | 3.9.13 |
| GHSA-jcmh-x32v-7mgf Cloud Foundry UAA privilege escalation with user invitations |
Critical EPSS 1.17% |
>= 3.0.0, < 3.6.11 | 3.6.11 |
| GHSA-jcmh-x32v-7mgf Cloud Foundry UAA privilege escalation with user invitations |
Critical EPSS 1.17% |
>= 2.0.0, < 2.7.4.17 | 2.7.4.17 |
| GHSA-fm5c-2rwc-887w Cloud Foundry UAA reset password vulnerable to brute force attack |
High EPSS 1.19% |
< 3.3.0.1 | 3.3.0.1 |
| GHSA-hxgw-7539-pv7r Cloud Foundry denial of service vulnerability |
High EPSS 1.58% |
< 3.9.8 | 3.9.8 |
| GHSA-hxgw-7539-pv7r Cloud Foundry denial of service vulnerability |
High EPSS 1.58% |
>= 3.10.0, < 3.12.0 | 3.12.0 |
| GHSA-8v97-gv3g-32rf UAA privilege escalation across identity zones |
High EPSS 1.29% |
>= 4.12.0, < 4.12.2 | 4.12.2 |
| GHSA-8v97-gv3g-32rf UAA privilege escalation across identity zones |
High EPSS 1.29% |
>= 4.13.0, < 4.13.4 | 4.13.4 |
| GHSA-fj69-p8f6-q97h Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password |
Low EPSS 0.82% |
< 2.2.5 | 2.2.5 |
| GHSA-h533-q6jc-qx28 Cloud Foundry Runtime Insufficient Session Expiration vulnerability |
Critical EPSS 1.17% |
< 2.5.2 | 2.5.2 |
| GHSA-cq6m-74r4-x77g Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password |
Critical EPSS 1.17% |
< 2.5.2 | 2.5.2 |
| GHSA-mpv3-g527-fqrj Cloud Foundry Runtime Cross-Site Request Forgery vulnerability |
High EPSS 0.76% |
< 2.5.2 | 2.5.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor