CVE-2019-11282

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@pivotal.io

Published

2019-10-23

Last modified

2024-09-16

Weaknesses

CWE-200, CWE-74

Affected products

• Cf Deployment (Cloud Foundry)
• Uaa Release (Cloud Foundry)
• Cf-deployment (Cloudfoundry)
• Cloud Foundry Uaa (Pivotal Software)

References

• https://www.cloudfoundry.org/blog/cve-2019-11282