PT-2019-12218 · Cloud Foundry · Cloud Foundry Uaa

Yuval Avrahami · Published 2019-08-05 · Updated 2020-10-02 · CVE-2019-11270

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0

Description The issue allows a malicious client with the clients.write authority or scope to bypass restrictions and create clients with arbitrary scopes that the creator does not possess. This can lead to privilege escalation.

Recommendations For Cloud Foundry UAA versions prior to 73.4.0, update to version 73.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the clients.write authority or scope to minimize the risk of exploitation. Restrict access to client creation via clients.write to prevent malicious clients from bypassing restrictions.

Fix

Incorrect Permission

Improper Privilege Management

Weakness Enumeration

CWE-732

CWE-269

Related Identifiers

CVE-2019-11270

Affected Products

Cloud Foundry Uaa

References · 9

• https://cloudfoundry.org/blog/cve-2019-11270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11270 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11270 · Vendor Advisory
• https://pivotal.io/security/cve-2019-11270 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11270 · Note
• https://t.me/defcon_news/21069 · Telegram Post
• https://t.me/rnetsec/10136 · Telegram Post
• https://t.me/canyoupwnme/5813 · Telegram Post
• https://t.me/secharvester/7086 · Telegram Post