CVE-2025-22216 — CVE-2025-22216 UAA Missing Zone Validation

CVE-2025-22216

CVE-2025-22216 UAA Missing Zone Validation PUBLISHED

Description (CNA)

A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones.

Affected (CNA)

Vendor / product	Versions
Cloud Foundry / Cloud Foundry UAA	affected 77.20.X before 77.20.2; affected 77.2X.0 before 77.25.0

CWE

No CWE identifiers supplied.

References

https://www.cloudfoundry.org/blog/cve-2025-22216-uaa-missing-zone-validation/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.