CVE-2019-11279: Privilege Escalation via Scope Manipulation in UAA
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2019-11279.
What is the severity level of CVE-2019-11279?
CVE-2019-11279 has a severity level of high.
What is the affected software for CVE-2019-11279?
The affected software for CVE-2019-11279 is Cloudfoundry Uaa Release versions up to but not including 74.1.0.
How can a remote malicious user exploit CVE-2019-11279?
A remote malicious user can exploit CVE-2019-11279 by submitting an array of requested scopes, allowing them to escalate their privileges and take control of UAA and the resources it controls.
Is there a fix available for CVE-2019-11279?
Yes, a fix is available for CVE-2019-11279. Users should update to version 74.1.0 or later of Cloudfoundry Uaa Release.