CVE-2019-11279 | BDVDB-2026-123243 Detail
Cloud FoundryUAA Release (OSS)
Description#
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.