Cloud Foundry vulnerable to Cross-Site Request Forgery
Critical severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 29, 2024
Package
Affected versions
>= 2.0.0, < 2.7.4.7
>= 3.0.0, < 3.3.0.5
>= 3.4.0, < 3.4.4
>= 3.5.0, < 3.7.0
Patched versions
2.7.4.7
3.3.0.5
3.4.4
3.7.0
Description
Published by the National Vulnerability Database
Sep 30, 2016
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Feb 29, 2024
Last updated
Feb 29, 2024
Credits
-
sunSUNQ Analyst
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.
References