User account and authentication

This hub aggregates every CVE we track for User account and authentication, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 9 most recently published vulnerabilities affecting User account and authentication.

• CVE-2023-20903This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to ...4.3Mar 28, 2023
• CVE-2021-22098UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of vict...6.1Aug 11, 2021
• CVE-2021-22001In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was ...7.5Jul 22, 2021
• CVE-2020-5402UAA fails to check the state parameter when authenticating with external IDPs8.8Feb 27, 2020
• CVE-2019-11293UAA logs all query parameters with debug logging level6.5Dec 6, 2019
• CVE-2019-11290Cloud Foundry UAA logs query parameters in tomcat access file7.5Nov 25, 2019
• CVE-2019-11278Privilege Escalation via Blind SCIM Injection in UAA8.8Sep 26, 2019
• CVE-2019-11274UAA SCIM Filter XSS6.1Aug 9, 2019
• CVE-2016-0732The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1....8.8Sep 7, 2017