PT-2019-12218 · Cloud Foundry · Cloud Foundry Uaa

Yuval Avrahami · Publicado 2019-08-05 · Atualizado 2020-10-02 · CVE-2019-11270

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0

Description The issue allows a malicious client with the clients.write authority or scope to bypass restrictions and create clients with arbitrary scopes that the creator does not possess. This can lead to privilege escalation.

Recommendations For Cloud Foundry UAA versions prior to 73.4.0, update to version 73.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the clients.write authority or scope to minimize the risk of exploitation. Restrict access to client creation via clients.write to prevent malicious clients from bypassing restrictions.

Correção

Incorrect Permission

Improper Privilege Management

Enumeração de Fraquezas

CWE-732

CWE-269

Identificadores relacionados

CVE-2019-11270

Produtos afetados

Cloud Foundry Uaa

Referências · 9

• https://cloudfoundry.org/blog/cve-2019-11270 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11270 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11270 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11270 · Nota
• https://t.me/defcon_news/21069 · Publicação no Telegram
• https://t.me/rnetsec/10136 · Publicação no Telegram
• https://t.me/canyoupwnme/5813 · Publicação no Telegram
• https://pivotal.io/security/cve-2019-11270 · Aviso do Fabricante
• https://t.me/secharvester/7086 · Publicação no Telegram