« Volver al listado

CVE-2018-11082

Estado: ModificadaCrítica (9.8)—

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Pivotal Software — Cloudfoundry UAAPivotal Software — Cloudfoundry UAA Release

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-11082",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Cloud Foundry",
          "product": "UAA Release",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "lessThan": "61.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Cloud Foundry",
          "product": "UAA",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "lessThan": "4.20.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-05T21:29:00.637",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2018-11082/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2018-11082/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user."
    },
    {
      "lang": "es",
      "value": "Cloud Foundry UAA, en todas las versiones anteriores a la 4.20.0 y Cloud Foundry UAA Release, en todas las versiones anteriores a la 61.0, permite la adivinación por fuerza bruta de códigos MFA. Un usuario remoto no autenticado malicioso que posea un nombre de usuario y contraseña válidos puede emplear fuerza bruta contra MFA para iniciar sesión como el usuario objetivo."
    }
  ],
  "lastModified": "2026-06-17T01:35:14.217",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloudfoundry_uaa:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB908BB2-520A-43DE-9BA2-72E8D485A23B",
              "versionEndExcluding": "4.20.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:cloudfoundry_uaa_release:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52A9DE11-CD2E-47AF-892F-F72E8F91815A",
              "versionEndExcluding": "61.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}