CVE-2018-11041

N/A

Published: June 25, 2018 at 03:00 PM UTC

Updated: June 17, 2026 at 01:35 AM UTC

3 products affected across 2 vendorsCloud Foundry UaaCloud Foundry Uaa ReleaseCloud Foundry UAA

Using Cloud Foundry UAA by Cloud Foundry?

Get instant alerts when new vulnerabilities affect Cloud Foundry UAA - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.9%

Description

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Cloud Foundry Uaa · Pivotal

95%

4.10.1 < v < 4.19.04.6.0 < v < 4.7.54.7.5 < v < 4.10.1

Affected range stops below 4.10.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.19.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.7.5, so it looks safe — our inference, not a vendor statement

Cloud Foundry Uaa Release · Pivotal

95%

48 < v < 52.952.9 < v < 55.155.1 < v < 60

Affected range stops below 52.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 55.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 60, so it looks safe — our inference, not a vendor statement

Cloud Foundry UAA · Cloudfoundry

60%

v < 4.19.0

Affected range stops below 4.19.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://www.cloudfoundry.org/blog/cve-2018-11041/

CVSS

5.8MEDIUM[email protected]

Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-601

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card