What’s Vulnerable › Vulnerabilities

CVE-2018-11082: Cloud Foundry UAA MFA does not prevent brute force of MFA code

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-10-05 · updated 2026-06-17
• Weakness: CWE-307

Description

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

Affected products

• Pivotal Software Cloudfoundry Uaa: before 4.20.0 — fixed in 4.20.0
• Pivotal Software Cloudfoundry Uaa Release: before 61.0 — fixed in 61.0

How to fix

Upgrade to a fixed version: Pivotal Software Cloudfoundry Uaa 4.20.0; Pivotal Software Cloudfoundry Uaa Release 61.0. Check the vendor advisory for mitigations.

References

• https://www.cloudfoundry.org/blog/cve-2018-11082/
• https://www.cloudfoundry.org/blog/cve-2018-11082/

Get alerted when CVE-2018-11082 or the next vulnerability affects your stack