Uaa Release
Vendor:
First CVE: Sep 7, 2017 · Active for 8 years
8
Total CVEs
More Total CVEs than 85% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Uaa Release over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 7, 2017
8 years ago
Most Recent CVE
Mar 5, 2026
143 days ago
CVE Severity & Scoring
Uaa Release8 CVEs
50%
38%
13%
All CVEs352,713 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (87.5%)
High1 (12.5%)
Unknown0 (0.0%)
User Interaction
None7 (87.5%)
Unknown0 (0.0%)
Required1 (12.5%)
Privileges Required
Low5 (62.5%)
High0 (0.0%)
None3 (37.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-3801CRITICAL Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated mali | Apr 25, 2019 | 9.8 | 31 | NO | NO |
CVE-2019-11279HIGH CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own | Sep 26, 2019 | 8.8 | 28 | NO | NO |
CVE-2016-0732HIGH The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and E | Sep 7, 2017 | 8.8 | 26 | NO | NO |
CVE-2026-22723MEDIUM Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48. | Mar 5, 2026 | 6.5 | 22 | NO | NO |
CVE-2019-3775MEDIUM Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email ad | Mar 7, 2019 | 6.5 | 22 | NO | NO |
CVE-2019-3788MEDIUM Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect | Apr 25, 2019 | 6.1 | 21 | NO | NO |
CVE-2025-22246HIGH Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. | May 13, 2025 | 7.5 | 20 | NO | NO |
CVE-2017-8031MEDIUM An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior t | Nov 27, 2017 | 5.3 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Uaa Release
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 52 | 1 | 5.3 | 1.1% | 0 | 0 |
| 4 | 1 | 8.8 | 1.1% | 0 | 0 |
| 3 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2 | 1 | 8.8 | 1.1% | 0 | 0 |