CVE-2018-11082 MEDIUM

CVE-2018-11082: Cloud Foundry UAA MFA does not prevent brute force of MFA code

Vendor Cloud Foundry
Product UAA Release
Published October 5, 2018
Last update September 17, 2024

CVSS base score

6.6/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

Key dates

02Disclosure timeline

October 5, 2018 CVE published
September 17, 2024 Record updated