CVE-2018-11041: Pivotal Software Cloud Foundry Uaa

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.

Affected products

• Pivotal Software Cloud Foundry Uaa: after 4.6.0, before 4.7.5 (fixed in 4.7.5); after 4.7.5, before 4.10.1 (fixed in 4.10.1); after 4.10.1, before 4.19.0 (fixed in 4.19.0)
• Pivotal Software Cloud Foundry Uaa-Release: after 48, before 52.9 (fixed in 52.9); after 52.9, before 55.1 (fixed in 55.1); after 55.1, before 60 (fixed in 60)

Published 2018-06-25. Last modified 2026-06-17.