Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.cloudfoundry.identity:cloudfoundry-identity-server(Maven) | 0 | 4.23.0 | N/A |
CVSS Metrics
