PT-2019-12221 · Cloud Foundry · Cloud Foundry Uaa

Published 2019-08-09 · Updated 2023-03-31 · CVE-2019-11274

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 74.0.0

Description The issue allows a remote unauthenticated malicious attacker to craft a URL that contains a SCIM filter with malicious JavaScript. This JavaScript may be executed by older browsers, leading to an XSS attack.

Recommendations For versions prior to 74.0.0, update to version 74.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCIM filter functionality until a patch is applied. Avoid using older browsers that may execute malicious JavaScript in the affected URL.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11274

Affected Products

Cloud Foundry Uaa

References · 4

• https://osv.dev/vulnerability/CVE-2019-11274 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2019-11274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11274 · Security Note
• https://t.me/cvenotify/47256 · Telegram Post