Vulnerability Name:

CVE-2017-4960 (CCN-123641)

Assigned:2016-12-29
Published:2017-03-08
Updated:2021-08-06
Summary:An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2017-4960

Source: BID
Type: Third Party Advisory, VDB Entry
96780

Source: CCN
Type: BID-96780
Multiple Cloud Foundry Products CVE-2017-4960 Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
cloudfoundry-cve20174960-dos(123641)

Source: CCN
Type: Cloud Foundry Web site
CVE-2017-4960: UAA OAuth DOS via lockout feature

Source: CONFIRM
Type: Vendor Advisory
https://www.cloudfoundry.org/cve-2017-4960/

Vulnerable Configuration:Configuration 1:
  • cpe:/a:pivotal_software:cloud_foundry_uaa:3.10.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry:250.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry:248.0:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:22:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:23:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.11.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry:247.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry:252.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry:249.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:cloud_foundry:251.0:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:25:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:26:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:*
  • OR cpe:/a:cloudfoundry:cloud_foundry_uaa_bosh:21:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    pivotal_software cloud foundry uaa 3.10.0
    pivotal_software cloud foundry uaa 3.9.6
    pivotal_software cloud foundry uaa 3.9.8
    cloudfoundry cloud foundry uaa bosh 24.3
    cloudfoundry cloud foundry uaa bosh 24.5
    pivotal_software cloud foundry 250.0
    pivotal_software cloud foundry 248.0
    cloudfoundry cloud foundry uaa bosh 22
    cloudfoundry cloud foundry uaa bosh 23
    cloudfoundry cloud foundry uaa bosh 24
    cloudfoundry cloud foundry uaa bosh 24.1
    pivotal_software cloud foundry uaa 3.9.5
    pivotal_software cloud foundry uaa 3.11.0
    pivotal_software cloud foundry 247.0
    pivotal_software cloud foundry uaa 3.9.0
    pivotal_software cloud foundry uaa 3.9.3
    pivotal_software cloud foundry 252.0
    pivotal_software cloud foundry uaa 3.9.2
    pivotal_software cloud foundry uaa 3.9.7
    pivotal_software cloud foundry uaa 3.9.1
    pivotal_software cloud foundry 249.0
    pivotal_software cloud foundry uaa 3.9.4
    pivotal_software cloud foundry 251.0
    cloudfoundry cloud foundry uaa bosh 25
    cloudfoundry cloud foundry uaa bosh 26
    cloudfoundry cloud foundry uaa bosh 24.6
    cloudfoundry cloud foundry uaa bosh 24.4
    cloudfoundry cloud foundry uaa bosh 24.2
    cloudfoundry cloud foundry uaa bosh 21