An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| CWE ID | Type | Source |
|---|---|---|
| NVD-CWE-noinfo | Primary | nvd@nist.gov |
| Hyperlink | Source | Resource |
|---|---|---|
| http://www.securityfocus.com/bid/96780 | security_alert@emc.com | Third Party Advisory VDB Entry |
| https://www.cloudfoundry.org/cve-2017-4960/ | security_alert@emc.com | Vendor Advisory |
| http://www.securityfocus.com/bid/96780 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| https://www.cloudfoundry.org/cve-2017-4960/ | af854a3a-2127-422b-91ae-364da2661108 | Vendor Advisory |