CVE-2017-4963

HIGH

Cloud Foundry Foundation Cloud Foundry <v252 - Session Fixation

Title source: llm

Description

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.cloudfoundry.org/cve-2017-4963/

Scores

CVSS v3 8.1

EPSS 0.0090

EPSS Percentile 54.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-384

Status published

Products (4)

n/a/Cloud Foundry Foundation Cloud Foundry Foundation

pivotal_software/cloud_foundry_cf-release < 252

pivotal_software/cloud_foundry_uaa 2.0.0 - 2.7.4.12

pivotal_software/cloud_foundry_uaa-release < 26

Published Jun 13, 2017

Tracked Since Feb 18, 2026