CVE-2018-11082

Published: Oct 5, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

Affected (2)

Products: Pivotal Software: Cloudfoundry Uaa, Cloudfoundry Uaa Release

Pivotal Software

2 products

Cloudfoundry Uaa

Cloudfoundry Uaa Release

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Cloudfoundry Uaa	Before 4.20.0
Pivotal Software Cloudfoundry Uaa Release	Before 61.0

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://www.cloudfoundry.org/blog/cve-2018-11082/

Source: security_alert@emc.com

Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2018-11082/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.