{"id":"CVE-2017-4991","details":"An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.","aliases":["GHSA-cgrg-x34r-78f3"],"modified":"2026-08-27T03:47:37.771038982Z","published":"2017-06-13T06:29:00.737Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2.2.5.4"},{"last_affected":"2.2.5.4"},{"introduced":"2.2.5.4"},{"last_affected":"2.2.5.4"}],"source":"CPE_STRING","vendor_product":"pivotal_software:cloud_foundry_uaa","cpes":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://www.cloudfoundry.org/cve-2017-4991/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry-attic/cf-release","events":[{"introduced":"0"},{"last_affected":"01ccfbbb01bb8824594f67529a4c325214507f08"}],"database_specific":{"cpe":"cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"259"}],"source":"CPE_RANGE"}}],"versions":["v259","v253","v249","v245","v205","v183","v170","v161","v157","v156","rc145.0","v143","works-for-us","v140","v137","v136","v135","v134","v133","v132","scotty_09012012","v119","v109","v105","v104","v103","v102","v100","v99","-","log","list"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4991.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa","events":[{"introduced":"0"},{"last_affected":"4bb775f81099c9eac8819688a7392bcd1a1fd758"},{"introduced":"7640c1433ec193b6696ee5e37a524a353fb3053e"},{"last_affected":"ffed4307232dc238ca9527716d176e68d9a25ce0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"4.2.0"},{"introduced":"2.2.5.4"},{"last_affected":"2.2.5.4"},{"introduced":"2.7.1"},{"last_affected":"2.7.1"},{"introduced":"2.7.2"},{"last_affected":"2.7.2"},{"introduced":"2.7.3"},{"last_affected":"2.7.3"},{"introduced":"2.7.4"},{"last_affected":"2.7.4"},{"introduced":"2.7.4.1"},{"last_affected":"2.7.4.1"},{"introduced":"2.7.4.2"},{"last_affected":"2.7.4.2"},{"introduced":"2.7.4.3"},{"last_affected":"2.7.4.3"},{"introduced":"2.7.4.4"},{"last_affected":"2.7.4.4"},{"introduced":"2.7.4.5"},{"last_affected":"2.7.4.5"},{"introduced":"2.7.4.6"},{"last_affected":"2.7.4.6"},{"introduced":"2.7.4.7"},{"last_affected":"2.7.4.7"},{"introduced":"2.7.4.8"},{"last_affected":"2.7.4.8"},{"introduced":"2.7.4.9"},{"last_affected":"2.7.4.9"},{"introduced":"2.7.4.11"},{"last_affected":"2.7.4.11"},{"introduced":"2.7.4.12"},{"last_affected":"2.7.4.12"},{"introduced":"2.7.4.13"},{"last_affected":"2.7.4.13"},{"introduced":"2.7.4.14"},{"last_affected":"2.7.4.14"},{"introduced":"2.7.4.15"},{"last_affected":"2.7.4.15"},{"introduced":"3.6.1"},{"last_affected":"3.6.1"},{"introduced":"3.6.2"},{"last_affected":"3.6.2"},{"introduced":"3.6.3"},{"last_affected":"3.6.3"},{"introduced":"3.6.4"},{"last_affected":"3.6.4"},{"introduced":"3.6.5"},{"last_affected":"3.6.5"},{"introduced":"3.6.6"},{"last_affected":"3.6.6"},{"introduced":"3.6.7"},{"last_affected":"3.6.7"},{"introduced":"3.6.8"},{"last_affected":"3.6.8"},{"introduced":"3.6.9"},{"last_affected":"3.6.9"},{"introduced":"3.9.1"},{"last_affected":"3.9.1"},{"introduced":"3.9.2"},{"last_affected":"3.9.2"},{"introduced":"3.9.3"},{"last_affected":"3.9.3"},{"introduced":"3.9.4"},{"last_affected":"3.9.4"},{"introduced":"3.9.5"},{"last_affected":"3.9.5"},{"introduced":"3.9.6"},{"last_affected":"3.9.6"},{"introduced":"3.9.7"},{"last_affected":"3.9.7"},{"introduced":"3.9.8"},{"last_affected":"3.9.8"},{"introduced":"3.9.9"},{"last_affected":"3.9.9"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:*"]}}],"versions":["2.2.5.4","2.7.1","2.7.2","2.7.3","2.7.4","2.7.4.1","2.7.4.11","2.7.4.12","2.7.4.13","2.7.4.14","2.7.4.15","2.7.4.2","2.7.4.3","2.7.4.4","2.7.4.5","2.7.4.6","2.7.4.7","2.7.4.8","2.7.4.9","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5","3.9.6","3.9.7","3.9.8","3.9.9","4.2.0","4.1.0","3.16.0","4.0.0","3.15.0","3.14.0","3.13.0","3.12.0","3.11.0","3.10.0","3.9.0","3.8.0","travis-success-1497","travis-success-1478","travis-success-1475","1.8.0","1.6.2","1.6.1","1.5.4.1","1.5.4","1.5.3","1.5.2.1","1.5.2","1.5.0","1.4.7","1.4.6","1.4.5","1.4.3","1.4.2","1.4.1","1.4.0","1.2.6","1.2.0","1.1.2","1.1.1","1.1","1.0.3","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4991.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa-release","events":[{"introduced":"0"},{"last_affected":"06f0f6c648c5841e016953d2e1604a1ef0246bd6"},{"introduced":"9e9bc18c684b92f99e5ff97b857729ebb657f993"},{"last_affected":"7ddaaef684e51ca03c86a34361e704323419d5aa"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.12:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.13:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.7:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.8:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.9:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.10:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"35"},{"introduced":"13.1"},{"last_affected":"13.1"},{"introduced":"13.2"},{"last_affected":"13.2"},{"introduced":"13.3"},{"last_affected":"13.3"},{"introduced":"13.4"},{"last_affected":"13.4"},{"introduced":"13.5"},{"last_affected":"13.5"},{"introduced":"13.6"},{"last_affected":"13.6"},{"introduced":"13.7"},{"last_affected":"13.7"},{"introduced":"13.8"},{"last_affected":"13.8"},{"introduced":"13.9"},{"last_affected":"13.9"},{"introduced":"13.10"},{"last_affected":"13.10"},{"introduced":"13.11"},{"last_affected":"13.11"},{"introduced":"13.12"},{"last_affected":"13.12"},{"introduced":"13.13"},{"last_affected":"13.13"},{"introduced":"24"},{"last_affected":"24"},{"introduced":"24.1"},{"last_affected":"24.1"},{"introduced":"24.2"},{"last_affected":"24.2"},{"introduced":"24.3"},{"last_affected":"24.3"},{"introduced":"24.4"},{"last_affected":"24.4"},{"introduced":"24.5"},{"last_affected":"24.5"},{"introduced":"24.6"},{"last_affected":"24.6"},{"introduced":"24.7"},{"last_affected":"24.7"},{"introduced":"24.8"},{"last_affected":"24.8"},{"introduced":"24.9"},{"last_affected":"24.9"},{"introduced":"24.10"},{"last_affected":"24.10"},{"introduced":"30"},{"last_affected":"30"},{"introduced":"30.1"},{"last_affected":"30.1"}]}}],"versions":["13.1","13.10","13.11","13.12","13.13","13.2","13.3","13.4","13.5","13.6","13.7","24","24.1","24.10","24.2","24.3","24.4","24.5","24.6","24.7","24.8","24.9","30","30.1","v30.1","v35","v30","v31","v27","v26","v24","v25","v23","v22","v21","v20","v19","v18","v17","v16","v15","v14","v12.3","ci-upgrade","v12","v11","v10","v9","v8","v7","v6","v3","v2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4991.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}