org.cloudfoundry.identity:cloudfoundry-identity-server@4.1.0 vulnerabilities

  • latest version

    4.30.0

  • first published

    9 years ago

  • latest version published

    6 years ago

  • licenses detected

  • package registry

  • Direct Vulnerabilities

    Known vulnerabilities in the org.cloudfoundry.identity:cloudfoundry-identity-server package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Authentication

    org.cloudfoundry.identity:cloudfoundry-identity-server is a Cloud Foundry User Account and Authentication (UAA) Server.

    Affected versions of this package are vulnerable to Improper Authentication due to improper session validation across multiple identity zones. An attacker can access unauthorized zones by reusing a session identifier (jsessionid) originally authenticated against a different identity provider.

    How to fix Improper Authentication?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • M
    Denial of Service (DoS)

    org.cloudfoundry.identity:cloudfoundry-identity-server is a Cloud Foundry User Account and Authentication (UAA) Server.

    Affected versions of this package are vulnerable to Denial of Service (DoS) in the client token revocation endpoint. A user for a particular client can revoke client tokens for other users on the same client if the target is using opaque tokens or JWT tokens validated using the check_token endpoint.

    How to fix Denial of Service (DoS)?

    Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to version 4.5.6, 4.7.1 or higher.

    [,4.5.6)[4.6.0,4.7.1)
    • H
    Improper Restriction of Security Token Assignment

    org.cloudfoundry.identity:cloudfoundry-identity-server is a Cloud Foundry User Account and Authentication (UAA) Server.

    Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment that allows a remote authenticated user to modify the URL and content of a consent page to access a token with arbitrary scopes that escalates their privileges.

    How to fix Improper Restriction of Security Token Assignment?

    Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to version 4.23.0 or higher.

    [,4.23.0)
    • M
    Arbitrary Code Injection

    org.cloudfoundry.identity:cloudfoundry-identity-server is a Cloud Foundry User Account and Authentication (UAA) Server.

    Affected versions of this package are vulnerable to Arbitrary Code Injection. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

    How to fix Arbitrary Code Injection?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • M
    Improper Authentication

    org.cloudfoundry.identity:cloudfoundry-identity-server is a Cloud Foundry User Account and Authentication (UAA) Server.

    Affected versions of this package are vulnerable to Improper Authentication. Due to improper checks of cookie secure flag.

    How to fix Improper Authentication?

    Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to version 74.25.0 or higher.

    [0,74.25.0)