CVE-2019-11293highCWE-532

CVE-2019-11293: falha de alta gravidade em Cloud Foundry UAA Release

UAA logs all query parameters with debug logging level

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar UAA

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 1.3%
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Cloud Foundry · UAA Release
CVEs relacionadas — Cloud Foundry UAA Release

No mesmo produto, das mais perigosas para as menos.

CVE-2018-15754MEDIUMUAA can issue tokens across identity providers if users with matching usernames existEPSS 1.8%CVE-2018-15761CRITICALUAA Privilege EscalationEPSS 1.7%CVE-2019-11290HIGHCloud Foundry UAA logs query parameters in tomcat access fileEPSS 1.3%CVE-2019-11282MEDIUMUAA is vulnerable to a Blind SCIM injection leading to information disclosureEPSS 1.1%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%