CVE-2021-22001

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	Cloud Foundry UAA server	Cloud Foundry UAA server prior to version 75.3.0

References

Timeline

Published: Jul 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-220029.8VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 CVE-2021-220037.5VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network acc CVE-2021-220046.4An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf CVE-2021-220059.8The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 4 CVE-2021-220067.5The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network CVE-2021-220075.5The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administra CVE-2021-220087.5The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to CVE-2021-220097.5The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access CVE-2021-22014.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.23 an CVE-2021-220107.5The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter CVE-2021-220115.3vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network acce CVE-2021-220127.5The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wi