Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially crafted application that interacts with a configured SAML provider.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud_foundry_uaa_bosh | Cloudfoundry | * | 23.0 (including) |
| Cloud_foundry | Pivotal_software | * | 247.0 (including) |
| Cloud_foundry_uaa | Pivotal_software | * | 3.9.2 (including) |