CVE-2021-22001: Cloudfoundry Cf-Deployment

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.

Affected products

• Cloudfoundry Cf-Deployment: before 16.18.0 (fixed in 16.18.0)
• Cloudfoundry User Account And Authentication: before 75.3.0 (fixed in 75.3.0)

Published 2021-07-22. Last modified 2026-06-17.