PT-2019-12217 · Cloud Foundry · Cloud Foundry Uaa

Yuval Avrahami · Publicado 2019-06-29 · Atualizado 2020-10-02 · CVE-2019-11268

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.3.0

Description The issue concerns improper escaping in certain endpoints, allowing an authenticated malicious user with basic read privileges for one identity zone to extend those privileges to all other identity zones. This enables the malicious user to obtain private information on users, clients, and groups in all other identity zones.

Recommendations For versions prior to 73.3.0, update to version 73.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints to minimize the risk of exploitation. Additionally, limit the privileges of users with basic read access to prevent them from extending their access to other identity zones.

Correção

Information Disclosure

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-200

CWE-116

Identificadores relacionados

CVE-2019-11268

Produtos afetados

Cloud Foundry Uaa

Referências · 8

• https://cloudfoundry.org/blog/cve-2019-11268 · Aviso do Fabricante
• https://t.me/defcon_news/17706 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-11268 · Nota de Segurança
• https://t.me/canyoupwnme/5682 · Publicação no Telegram
• https://t.me/malwr/1485 · Publicação no Telegram
• https://t.me/rnetsec/9831 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-11268 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11268 · Nota