VulnerabilityModified
CVE-2021-22001
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
HIGH 7.5EPSS 0.99%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.99% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- cloudfoundry/cf-deployment · cloudfoundry/user account and authentication
- Source
- security@vmware.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.