User Account And Authentication
Vendor:
First CVE: Sep 7, 2017 · Active for 8 years
9
Total CVEs
More Total CVEs than 88% of tracked products
1.8
Avg CVEs / Year
Higher CVE frequency than 63% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 47% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact User Account And Authentication over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 7, 2017
8 years ago
Most Recent CVE
Mar 28, 2023
1,218 days ago
CVE Severity & Scoring
User Account And Authentication9 CVEs
44%
56%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network9 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (66.7%)
Unknown0 (0.0%)
Required3 (33.3%)
Privileges Required
Low4 (44.4%)
High0 (0.0%)
None5 (55.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-11278HIGH CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which | Sep 26, 2019 | 8.8 | 27 | NO | NO |
CVE-2016-0732HIGH The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and E | Sep 7, 2017 | 8.8 | 26 | NO | NO |
CVE-2021-22001HIGH In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oa | Jul 22, 2021 | 7.5 | 24 | NO | NO |
CVE-2020-5402HIGH In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with e | Feb 27, 2020 | 8.8 | 24 | NO | NO |
CVE-2019-11290HIGH Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials | Nov 26, 2019 | 7.5 | 23 | NO | NO |
CVE-2019-11293MEDIUM Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malici | Dec 6, 2019 | 6.5 | 21 | NO | NO |
CVE-2019-11274MEDIUM Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains | Aug 9, 2019 | 6.1 | 21 | NO | NO |
CVE-2021-22098MEDIUM UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to | Aug 11, 2021 | 6.1 | 20 | NO | NO |
CVE-2023-20903MEDIUM This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh to | Mar 28, 2023 | 4.3 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For User Account And Authentication
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.7.3 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.7.2 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.7.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.7.0.3 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.7.0.2 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.7.0.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.7.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.6.2 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.6.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.6.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.5.2 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.5.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.5.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.4.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.4.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.3.1.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.3.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.3.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.2.6 | 1 | 8.8 | 1.1% | 0 | 0 |
| 2.2.5.3 | 1 | 8.8 | 1.1% | 0 | 0 |