PT-2019-12221 · Cloud Foundry · Cloud Foundry Uaa

CVE-2019-11274 · Publicado 2019-08-09 · Atualizado 2023-03-31

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 74.0.0

Description The issue allows a remote unauthenticated malicious attacker to craft a URL that contains a SCIM filter with malicious JavaScript. This JavaScript may be executed by older browsers, leading to an XSS attack.

Recommendations For versions prior to 74.0.0, update to version 74.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCIM filter functionality until a patch is applied. Avoid using older browsers that may execute malicious JavaScript in the affected URL.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11274

Produtos afetados

Cloud Foundry Uaa

Referências · 4

• https://t.me/cvenotify/47256 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-11274 · Aviso do Fabricante
• https://cloudfoundry.org/blog/cve-2019-11274 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11274 · Nota de Segurança