CVE-2018-11082 - OpenCVE

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Pivotal Software	Cloudfoundry Uaa Cloudfoundry Uaa Release

Configuration 1 [-]

OR	cpe:2.3:a:pivotal_software:cloudfoundry_uaa::::::::
	cpe:2.3:a:pivotal_software:cloudfoundry_uaa_release::::::::

No data.

References

Link	Providers
https://www.cloudfoundry.org/blog/cve-2018-11082/

History

No history.

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2018-10-05T21:00:00Z

Updated: 2024-09-17T02:00:59.932Z

Reserved: 2018-05-14T00:00:00

Link: CVE-2018-11082

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-10-05T21:29:00.637

Modified: 2019-10-09T23:33:23.557

Link: CVE-2018-11082

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "UAA Release", "vendor": "Cloud Foundry", "versions": [{"lessThan": "61.0", "status": "affected", "version": "all versions", "versionType": "custom"}]}, {"product": "UAA", "vendor": "Cloud Foundry", "versions": [{"lessThan": "4.20.0", "status": "affected", "version": "all versions", "versionType": "custom"}]}], "datePublic": "2018-10-01T00:00:00", "descriptions": [{"lang": "en", "value": "Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Improper Access Control", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-05T20:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cloudfoundry.org/blog/cve-2018-11082/"}], "source": {"discovery": "UNKNOWN"}, "title": "Cloud Foundry UAA MFA does not prevent brute force of MFA code", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2018-10-01T07:00:00.000Z", "ID": "CVE-2018-11082", "STATE": "PUBLIC", "TITLE": "Cloud Foundry UAA MFA does not prevent brute force of MFA code"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "UAA Release", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "all versions", "version_value": "61.0"}]}}, {"product_name": "UAA", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "all versions", "version_value": "4.20.0"}]}}]}, "vendor_name": "Cloud Foundry"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://www.cloudfoundry.org/blog/cve-2018-11082/", "refsource": "CONFIRM", "url": "https://www.cloudfoundry.org/blog/cve-2018-11082/"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T07:54:36.570Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cloudfoundry.org/blog/cve-2018-11082/"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2018-11082", "datePublished": "2018-10-05T21:00:00Z", "dateReserved": "2018-05-14T00:00:00", "dateUpdated": "2024-09-17T02:00:59.932Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pivotal_software:cloudfoundry_uaa:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB908BB2-520A-43DE-9BA2-72E8D485A23B", "versionEndExcluding": "4.20.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:cloudfoundry_uaa_release:*:*:*:*:*:*:*:*", "matchCriteriaId": "52A9DE11-CD2E-47AF-892F-F72E8F91815A", "versionEndExcluding": "61.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user."}, {"lang": "es", "value": "Cloud Foundry UAA, en todas las versiones anteriores a la 4.20.0 y Cloud Foundry UAA Release, en todas las versiones anteriores a la 61.0, permite la adivinaci\u00f3n por fuerza bruta de c\u00f3digos MFA. Un usuario remoto no autenticado malicioso que posea un nombre de usuario y contrase\u00f1a v\u00e1lidos puede emplear fuerza bruta contra MFA para iniciar sesi\u00f3n como el usuario objetivo."}], "id": "CVE-2018-11082", "lastModified": "2019-10-09T23:33:23.557", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2018-10-05T21:29:00.637", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.cloudfoundry.org/blog/cve-2018-11082/"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}]}