CVE-2018-11082: Pivotal Software Cloudfoundry Uaa

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.

Affected products

• Pivotal Software Cloudfoundry Uaa: before 4.20.0 (fixed in 4.20.0)
• Pivotal Software Cloudfoundry Uaa Release: before 61.0 (fixed in 61.0)

Published 2018-10-05. Last modified 2026-06-17.