CVE-2019-11270
High
Description
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.
SeverityHigh
CVSS7.5
Exploit probability—
ProductPivotal Software Cloud Foundry Uaa
PublishedAug 5, 2019
First seenAug 5, 2019
Weakness typeCWE-269Improper privilege management
How to fix
Update
- pivotal_software cloud_foundry_uaa73.4.0 or later
- pivotal_software application_service2.3.15, 2.4.11, 2.5.7, 2.6.2 or later
- pivotal_software operations_manager2.3.22, 2.4.16, 2.5.10, 2.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software cloud_foundry_uaa | v < 73.4.0 | 73.4.0 |
| pivotal_software application_service | 2.3.0 ≤ v < 2.3.15, 2.4.0 ≤ v < 2.4.11, 2.5.0 ≤ v < 2.5.7, 2.6.0 ≤ v < 2.6.2 | 2.3.15, 2.4.11, 2.5.7, 2.6.2 |
| pivotal_software operations_manager | 2.3.0 ≤ v < 2.3.22, 2.4.0 ≤ v < 2.4.16, 2.5.0 ≤ v < 2.5.10, 2.6.0 ≤ v < 2.6.4 | 2.3.22, 2.4.16, 2.5.10, 2.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.