CVE-2019-11268

low-risk
Published 2019-07-11

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Cloud Foundry Uaa-Release

Affected Vendors

Pivotal Software

References (2)

Vendor Advisory https://www.cloudfoundry.org/blog/cve-2019-11268
Vendor Advisory https://www.cloudfoundry.org/blog/cve-2019-11268
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal