PT-2019-12233 · Cloud Foundry · Cloud Foundry Uaa

Publicado 2019-12-06 · Atualizado 2019-12-12 · CVE-2019-11293

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA Release versions prior to 74.10.0

Description The issue allows a remote authenticated malicious user to gain access to user credentials via the uaa.log file if authentication is provided via query parameters, when the logging level is set to DEBUG. This occurs because client secret credentials are logged when sent as a query parameter.

Recommendations For versions prior to 74.10.0, update to version 74.10.0 or later to resolve the issue. As a temporary workaround, consider setting the logging level to a value other than DEBUG to prevent the logging of client secret credentials. Restrict access to the uaa.log file to minimize the risk of exploitation. Avoid using query parameters for authentication until the issue is resolved.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2019-11293

Produtos afetados

Cloud Foundry Uaa

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-11293 · Aviso do Fabricante
• https://cloudfoundry.org/blog/cve-2019-11293 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11293 · Nota de Segurança