CVE-2019-11290: high-severity vulnerability in Cloud Foundry UAA Release
Cloud Foundry UAA logs query parameters in tomcat access file
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.3%
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cloud Foundry · UAA ReleaseRelated CVEs — Cloud Foundry UAA Release
In the same product, most dangerous first.
CVE-2018-15754MEDIUMUAA can issue tokens across identity providers if users with matching usernames existEPSS 1.8%CVE-2018-15761CRITICALUAA Privilege EscalationEPSS 1.7%CVE-2019-11293HIGHUAA logs all query parameters with debug logging levelEPSS 1.3%CVE-2019-11282MEDIUMUAA is vulnerable to a Blind SCIM injection leading to information disclosureEPSS 1.1%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%