Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/106240 | third party advisory vdb entry |
| https://www.cloudfoundry.org/blog/cve-2018-15754/ | mitigation vendor advisory |
| https://www.cloudfoundry.org/blog/cve-2018-15754 | mitigation vendor advisory |