CVE-2017-4991

high

Published 2017-06-13 · Modified 2024-03-01

CVSS v3

7.2

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2

6.5

VIR risk

7.2

Description

Cloud Foundry UAA password reset vulnerability

Predictions

Exploit likelihood

81%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security_alert@emc.com — https://www.cloudfoundry.org/cve-2017-4991/

Package impact

Ecosystem	Package	Vulnerable	Fixed
Maven	org.cloudfoundry.identity:cloudfoundry-identity-server	`>=2.0.0,<2.7.4.16`	`2.7.4.16`
Maven	org.cloudfoundry.identity:cloudfoundry-identity-server	`>=3.0.0,<3.6.10`	`3.6.10`
Maven	org.cloudfoundry.identity:cloudfoundry-identity-server	`>=3.7.0,<3.9.12`	`3.9.12`
Maven	org.cloudfoundry.identity:cloudfoundry-identity-server	`>=3.10.0,<3.17.0`	`3.17.0`

Application impact

Vendor	Product	Versions
cloudfoundry	cf-release	`{"endIncluding":"259"}`
cloudfoundry	cloud_foundry_uaa_bosh	`{"endIncluding":"35"}`
cloudfoundry	cloud_foundry_uaa_bosh	`13.1`
cloudfoundry	cloud_foundry_uaa_bosh	`13.2`
cloudfoundry	cloud_foundry_uaa_bosh	`13.3`
cloudfoundry	cloud_foundry_uaa_bosh	`13.4`
cloudfoundry	cloud_foundry_uaa_bosh	`13.5`
cloudfoundry	cloud_foundry_uaa_bosh	`13.6`
cloudfoundry	cloud_foundry_uaa_bosh	`13.7`
cloudfoundry	cloud_foundry_uaa_bosh	`13.8`
cloudfoundry	cloud_foundry_uaa_bosh	`13.9`
cloudfoundry	cloud_foundry_uaa_bosh	`13.10`
cloudfoundry	cloud_foundry_uaa_bosh	`13.11`
cloudfoundry	cloud_foundry_uaa_bosh	`13.12`
cloudfoundry	cloud_foundry_uaa_bosh	`13.13`
cloudfoundry	cloud_foundry_uaa_bosh	`24`
cloudfoundry	cloud_foundry_uaa_bosh	`24.1`
cloudfoundry	cloud_foundry_uaa_bosh	`24.2`
cloudfoundry	cloud_foundry_uaa_bosh	`24.3`
cloudfoundry	cloud_foundry_uaa_bosh	`24.4`
cloudfoundry	cloud_foundry_uaa_bosh	`24.5`
cloudfoundry	cloud_foundry_uaa_bosh	`24.6`
cloudfoundry	cloud_foundry_uaa_bosh	`24.7`
cloudfoundry	cloud_foundry_uaa_bosh	`24.8`
cloudfoundry	cloud_foundry_uaa_bosh	`24.9`
cloudfoundry	cloud_foundry_uaa_bosh	`24.10`
cloudfoundry	cloud_foundry_uaa_bosh	`30`
cloudfoundry	cloud_foundry_uaa_bosh	`30.1`
pivotal_software	cloud_foundry_uaa	`{"endIncluding":"4.2.0"}`
pivotal_software	cloud_foundry_uaa	`2.2.5.4`
pivotal_software	cloud_foundry_uaa	`2.7.1`
pivotal_software	cloud_foundry_uaa	`2.7.2`
pivotal_software	cloud_foundry_uaa	`2.7.3`
pivotal_software	cloud_foundry_uaa	`2.7.4`
pivotal_software	cloud_foundry_uaa	`2.7.4.1`
pivotal_software	cloud_foundry_uaa	`2.7.4.2`
pivotal_software	cloud_foundry_uaa	`2.7.4.3`
pivotal_software	cloud_foundry_uaa	`2.7.4.4`
pivotal_software	cloud_foundry_uaa	`2.7.4.5`
pivotal_software	cloud_foundry_uaa	`2.7.4.6`
pivotal_software	cloud_foundry_uaa	`2.7.4.7`
pivotal_software	cloud_foundry_uaa	`2.7.4.8`
pivotal_software	cloud_foundry_uaa	`2.7.4.9`
pivotal_software	cloud_foundry_uaa	`2.7.4.11`
pivotal_software	cloud_foundry_uaa	`2.7.4.12`
pivotal_software	cloud_foundry_uaa	`2.7.4.13`
pivotal_software	cloud_foundry_uaa	`2.7.4.14`
pivotal_software	cloud_foundry_uaa	`2.7.4.15`
pivotal_software	cloud_foundry_uaa	`3.6.1`
pivotal_software	cloud_foundry_uaa	`3.6.2`
pivotal_software	cloud_foundry_uaa	`3.6.3`
pivotal_software	cloud_foundry_uaa	`3.6.4`
pivotal_software	cloud_foundry_uaa	`3.6.5`
pivotal_software	cloud_foundry_uaa	`3.6.6`
pivotal_software	cloud_foundry_uaa	`3.6.7`
pivotal_software	cloud_foundry_uaa	`3.6.8`
pivotal_software	cloud_foundry_uaa	`3.6.9`
pivotal_software	cloud_foundry_uaa	`3.9.1`
pivotal_software	cloud_foundry_uaa	`3.9.2`
pivotal_software	cloud_foundry_uaa	`3.9.3`
pivotal_software	cloud_foundry_uaa	`3.9.4`
pivotal_software	cloud_foundry_uaa	`3.9.5`
pivotal_software	cloud_foundry_uaa	`3.9.6`
pivotal_software	cloud_foundry_uaa	`3.9.7`
pivotal_software	cloud_foundry_uaa	`3.9.8`
pivotal_software	cloud_foundry_uaa	`3.9.9`

References

CWEs

CWE-269

Verify integrity in audit chain (admin only). AS-IS.