CVE-2019-11270highCWE-269

CVE-2019-11270: high-severity vulnerability in Cloud Foundry UAA Release (OSS)

UAA clients.write vulnerability

Published · Updated

Follow this CVE+ Monitor UAA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 1.1%
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected products
Cloud Foundry · UAA Release (OSS)
Related CVEs — Cloud Foundry UAA Release (OSS)

In the same product, most dangerous first.

CVE-2019-11278HIGHPrivilege Escalation via Blind SCIM Injection in UAAEPSS 1.3%CVE-2019-11279HIGHPrivilege Escalation via Scope Manipulation in UAAEPSS 1.3%CVE-2019-3787HIGHUAA defaults email address to an insecure domainEPSS 1.1%CVE-2019-3794MEDIUMUAA - Login app subject to clickjacking attackEPSS 1.1%CVE-2019-11268MEDIUMUAA SQL Identity Zone VulnerabilityEPSS 1.0%CVE-2019-3775HIGHUAA allows users to modify their own email addressEPSS 0.9%