VULNERABILITY INTELLIGENCE

CVE-2019-11268

CVSS score4.3 MEDIUM
EPSS probability1.01%
CISA KEVNot currently listed
Published2019-07-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.

Weakness classification

  • CWE-116: Improper Encoding or Escaping of Output
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references