PT-2019-12217 · Cloud Foundry · Cloud Foundry Uaa

Yuval Avrahami · Published 2019-06-29 · Updated 2020-10-02 · CVE-2019-11268

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.3.0

Description The issue concerns improper escaping in certain endpoints, allowing an authenticated malicious user with basic read privileges for one identity zone to extend those privileges to all other identity zones. This enables the malicious user to obtain private information on users, clients, and groups in all other identity zones.

Recommendations For versions prior to 73.3.0, update to version 73.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints to minimize the risk of exploitation. Additionally, limit the privileges of users with basic read access to prevent them from extending their access to other identity zones.

Fix

Information Disclosure

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-200

CWE-116

Related Identifiers

CVE-2019-11268

Affected Products

Cloud Foundry Uaa

References · 8

• https://cloudfoundry.org/blog/cve-2019-11268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11268 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11268 · Vendor Advisory
• https://t.me/defcon_news/17706 · Telegram Post
• https://t.me/canyoupwnme/5682 · Telegram Post
• https://t.me/malwr/1485 · Telegram Post
• https://t.me/rnetsec/9831 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11268 · Note