# org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) vulnerabilities 21 known vulnerabilities (1 critical, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.cloudfoundry.identity/cloudfoundry-identity-server ## Advisories (21) ### [CVE-2026-22723](https://cve.now/CVE-2026-22723): UAA User Token Revocation logic error - Severity: Medium 6.5 - Published: Mar 5, 2026 - Affected: from 77.30.0, fixed in 78.8.0. ### [CVE-2018-15761](https://cve.now/CVE-2018-15761): UAA Privilege Escalation - Severity: Critical 9.9 - Published: Nov 19, 2018 - Affected: fixed in 4.23.0. ### [CVE-2018-11047](https://cve.now/CVE-2018-11047): Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to… - Severity: Unrated - Published: Jul 24, 2018 - Affected: fixed in 4.5.7; from 4.6.0, fixed in 4.7.6; from 4.8.0, fixed in 4.10.2; from 4.11.0, fixed in 4.12.4; from 4.13.0, fixed in 4.19.2. ### [CVE-2018-11041](https://cve.now/CVE-2018-11041): Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior… - Severity: Unrated - Published: Jun 25, 2018 - Affected: fixed in 4.7.5; from 4.8.0, fixed in 4.10.1; from 4.11.0, fixed in 4.12.3; from 4.13.0, fixed in 4.19.0. ### [CVE-2018-1262](https://cve.now/CVE-2018-1262): Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity… - Severity: Unrated - Published: May 15, 2018 - Affected: from 4.12.0, fixed in 4.12.2; from 4.13.0, fixed in 4.13.4. ### [CVE-2018-1192](https://cve.now/CVE-2018-1192): In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5… - Severity: Unrated - Published: Feb 1, 2018 - Affected: fixed in 4.5.5; from 4.6.0, fixed in 4.7.4; from 4.8.0, fixed in 4.8.3. ### [CVE-2018-1190](https://cve.now/CVE-2018-1190): An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA… - Severity: Unrated - Published: Jan 4, 2018 - Affected: from 3.0.0, fixed in 3.20.2. ### [CVE-2017-8031](https://cve.now/CVE-2017-8031): An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x… - Severity: Unrated - Published: Nov 27, 2017 - Affected: from 4.6.0, fixed in 4.7.1; from 4.0.0, fixed in 4.5.3; fixed in 3.20.1. ### [CVE-2015-5172](https://cve.now/CVE-2015-5172): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow… - Severity: Unrated - Published: Oct 24, 2017 - Affected: fixed in 2.5.2. ### [CVE-2015-5171](https://cve.now/CVE-2015-5171): The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF)… - Severity: Unrated - Published: Oct 24, 2017 - Affected: fixed in 2.5.2. ### [CVE-2015-5170](https://cve.now/CVE-2015-5170): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote… - Severity: Unrated - Published: Oct 24, 2017 - Affected: fixed in 2.5.2. ### [CVE-2017-8032](https://cve.now/CVE-2017-8032): In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x… - Severity: Unrated - Published: Jul 10, 2017 - Affected: fixed in 3.6.13; from 3.7.0, fixed in 3.9.15; from 3.10.0, fixed in 3.20.0; from 4.0.0, fixed in 4.4.0. ### [CVE-2017-4992](https://cve.now/CVE-2017-4992): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x… - Severity: Unrated - Published: Jun 13, 2017 - Affected: from 2.0.0, fixed in 2.7.4.17; from 3.0.0, fixed in 3.6.11; from 3.7.0, fixed in 3.9.13; from 3.10.0, fixed in 4.2.0. ### [CVE-2017-4991](https://cve.now/CVE-2017-4991): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x… - Severity: Unrated - Published: Jun 13, 2017 - Affected: from 2.0.0, fixed in 2.7.4.16; from 3.0.0, fixed in 3.6.10; from 3.7.0, fixed in 3.9.12; from 3.10.0, fixed in 3.17.0. ### [CVE-2017-4974](https://cve.now/CVE-2017-4974): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x… - Severity: Unrated - Published: Jun 13, 2017 - Affected: from 2.0.0, fixed in 2.7.4.15; from 3.0.0, fixed in 3.6.9; from 3.7.0, fixed in 3.9.11; from 3.10.0, fixed in 3.16.0. ### [CVE-2017-4973](https://cve.now/CVE-2017-4973): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x… - Severity: Unrated - Published: Jun 13, 2017 - Affected: from 2.0.0, fixed in 2.7.4.14; from 3.0.0, fixed in 3.6.8; from 3.7.0, fixed in 3.9.10; from 3.10.0, fixed in 3.15.0. ### [CVE-2016-3084](https://cve.now/CVE-2016-3084): The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of… - Severity: Unrated - Published: May 25, 2017 - Affected: fixed in 3.3.0.1. ### [CVE-2015-3189](https://cve.now/CVE-2015-3189): With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime… - Severity: Unrated - Published: May 25, 2017 - Affected: fixed in 2.2.5. ### [CVE-2016-5016](https://cve.now/CVE-2016-5016): Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier… - Severity: Unrated - Published: Apr 24, 2017 - Affected: from 3.0.0, fixed in 3.3.0.3; from 3.4.0, fixed in 3.4.2. ### [CVE-2017-4960](https://cve.now/CVE-2017-4960): An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release… - Severity: Unrated - Published: Mar 10, 2017 - Affected: from 3.10.0, fixed in 3.12.0; fixed in 3.9.8. ### [CVE-2016-6637](https://cve.now/CVE-2016-6637): Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before… - Severity: Unrated - Published: Sep 30, 2016 - Affected: from 2.0.0, fixed in 2.7.4.7; from 3.0.0, fixed in 3.3.0.5; from 3.4.0, fixed in 3.4.4; from 3.5.0, fixed in 3.7.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.cloudfoundry.identity:cloudfoundry-identity-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.