Vulnerabilities > CVE-2019-11279 - Unspecified vulnerability in Cloudfoundry UAA Release

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

cloudfoundry

NVD

Published: 2019-09-26

Updated: 2020-10-05

Summary

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.

Vulnerable Configurations

Part	Description	Count
Application	Cloudfoundry Cloudfoundry UAA Release 2.0 Cloudfoundry UAA Release 3.0 Cloudfoundry UAA Release 4.0 Cloudfoundry UAA Release 5.0 Cloudfoundry UAA Release 6.0 Cloudfoundry UAA Release 7.0 Cloudfoundry UAA Release 8.0 Cloudfoundry UAA Release 9.0 Cloudfoundry UAA Release 10.0 Cloudfoundry UAA Release 11.0 Cloudfoundry UAA Release 11.1 Cloudfoundry UAA Release 11.2 Cloudfoundry UAA Release 11.3 Cloudfoundry UAA Release 11.4 Cloudfoundry UAA Release 11.5 Cloudfoundry UAA Release 11.7 Cloudfoundry UAA Release 12.0 Cloudfoundry UAA Release 12.1 Cloudfoundry UAA Release 12.2 Cloudfoundry UAA Release 12.3 Cloudfoundry UAA Release 12.4 Cloudfoundry UAA Release 12.5 Cloudfoundry UAA Release 12.6 Cloudfoundry UAA Release 13.0 Cloudfoundry UAA Release 13.1 Cloudfoundry UAA Release 13.2 Cloudfoundry UAA Release 13.3 Cloudfoundry UAA Release 13.4 Cloudfoundry UAA Release 13.5 Cloudfoundry UAA Release 13.6 Cloudfoundry UAA Release 13.7 Cloudfoundry UAA Release 13.8 Cloudfoundry UAA Release 13.9 Cloudfoundry UAA Release 13.10 Cloudfoundry UAA Release 13.11 Cloudfoundry UAA Release 13.12 Cloudfoundry UAA Release 13.13 Cloudfoundry UAA Release 13.14 Cloudfoundry UAA Release 13.15 Cloudfoundry UAA Release 13.16 Cloudfoundry UAA Release 13.17 Cloudfoundry UAA Release 13.18 Cloudfoundry UAA Release 14.0 Cloudfoundry UAA Release 15.0 Cloudfoundry UAA Release 16.0 Cloudfoundry UAA Release 17.0 Cloudfoundry UAA Release 18.0 Cloudfoundry UAA Release 19.0 Cloudfoundry UAA Release 20.0 Cloudfoundry UAA Release 21.0 Cloudfoundry UAA Release 22.0 Cloudfoundry UAA Release 23.0 Cloudfoundry UAA Release 24.0 Cloudfoundry UAA Release 24.1 Cloudfoundry UAA Release 24.2 Cloudfoundry UAA Release 24.3 Cloudfoundry UAA Release 24.4 Cloudfoundry UAA Release 24.5 Cloudfoundry UAA Release 24.6 Cloudfoundry UAA Release 24.7 Cloudfoundry UAA Release 24.8 Cloudfoundry UAA Release 24.9 Cloudfoundry UAA Release 24.10 Cloudfoundry UAA Release 24.11 Cloudfoundry UAA Release 24.12 Cloudfoundry UAA Release 24.13 Cloudfoundry UAA Release 24.14 Cloudfoundry UAA Release 25.0 Cloudfoundry UAA Release 26.0 Cloudfoundry UAA Release 27.0 Cloudfoundry UAA Release 28.0 Cloudfoundry UAA Release 29.0 Cloudfoundry UAA Release 30.0 Cloudfoundry UAA Release 30.1 Cloudfoundry UAA Release 30.2 Cloudfoundry UAA Release 30.3 Cloudfoundry UAA Release 30.4 Cloudfoundry UAA Release 30.5 Cloudfoundry UAA Release 30.6 Cloudfoundry UAA Release 30.7 Cloudfoundry UAA Release 30.8 Cloudfoundry UAA Release 30.9 Cloudfoundry UAA Release 31.0 Cloudfoundry UAA Release 32.0 Cloudfoundry UAA Release 33.0 Cloudfoundry UAA Release 34.0 Cloudfoundry UAA Release 34.1 Cloudfoundry UAA Release 34.2 Cloudfoundry UAA Release 34.3 Cloudfoundry UAA Release 35.0 Cloudfoundry UAA Release 36.0 Cloudfoundry UAA Release 37.0 Cloudfoundry UAA Release 38.0 Cloudfoundry UAA Release 39.0 Cloudfoundry UAA Release 40.0 Cloudfoundry UAA Release 41.0 Cloudfoundry UAA Release 41.1 Cloudfoundry UAA Release 43.0 Cloudfoundry UAA Release 44.0 Cloudfoundry UAA Release 45.0 Cloudfoundry UAA Release 45.1 Cloudfoundry UAA Release 45.2 Cloudfoundry UAA Release 45.3 Cloudfoundry UAA Release 45.4 Cloudfoundry UAA Release 45.5 Cloudfoundry UAA Release 45.6 Cloudfoundry UAA Release 45.7 Cloudfoundry UAA Release 45.8 Cloudfoundry UAA Release 45.9 Cloudfoundry UAA Release 45.10 Cloudfoundry UAA Release 45.11 Cloudfoundry UAA Release 48.0 Cloudfoundry UAA Release 50.0 Cloudfoundry UAA Release 51.0 Cloudfoundry UAA Release 52.0 Cloudfoundry UAA Release 52.1 Cloudfoundry UAA Release 52.2 Cloudfoundry UAA Release 52.4 Cloudfoundry UAA Release 52.5 Cloudfoundry UAA Release 52.6 Cloudfoundry UAA Release 52.7 Cloudfoundry UAA Release 52.8 Cloudfoundry UAA Release 52.9 Cloudfoundry UAA Release 52.10 Cloudfoundry UAA Release 53.0 Cloudfoundry UAA Release 53.1 Cloudfoundry UAA Release 53.2 Cloudfoundry UAA Release 53.3 Cloudfoundry UAA Release 54.0 Cloudfoundry UAA Release 55.0 Cloudfoundry UAA Release 55.1 Cloudfoundry UAA Release 55.2 Cloudfoundry UAA Release 56.0 Cloudfoundry UAA Release 57.0 Cloudfoundry UAA Release 57.1 Cloudfoundry UAA Release 57.2 Cloudfoundry UAA Release 57.3 Cloudfoundry UAA Release 57.4 Cloudfoundry UAA Release 58.0 Cloudfoundry UAA Release 58.1 Cloudfoundry UAA Release 59.0 Cloudfoundry UAA Release 60.0 Cloudfoundry UAA Release 60.2 Cloudfoundry UAA Release 61.0 Cloudfoundry UAA Release 62.0 Cloudfoundry UAA Release 63.0 Cloudfoundry UAA Release 64.0 Cloudfoundry UAA Release 66.0 Cloudfoundry UAA Release 67.0 Cloudfoundry UAA Release 68.0 Cloudfoundry UAA Release 69.0 Cloudfoundry UAA Release 70.0 Cloudfoundry UAA Release 71.0 Cloudfoundry UAA Release 72.0	154

References

https://www.cloudfoundry.org/blog/cve-2019-11279