Executive brief
Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint
Affected products
- Maven org.cloudfoundry.identity:cloudfoundry-identity-server
Junglewise Threat Intelligence
CVE-2018-1190: Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint
CVE-2018-1190 · Severity: low · CVSS 3 · Published 2022-05-13
Technologies: org.cloudfoundry.identity:cloudfoundry-identity-server (Maven). Vendors: Maven.
Related threats
- Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78
- Cloud Foundry UAA Privilege Escalation
- Cloud Foundry UAA reset password vulnerable to brute force attack
- Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
- Cloud Foundry Runtime Insufficient Session Expiration vulnerability