Description (CNA)
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cloud Foundry / UAA Release (OSS) | affected All before v71.0 |
| Pivotal / Pivotal Application Service | affected 2.5 before 2.5.1 |
CWE
CWE-601
References
ADP enrichment
No English description supplied.