CVE-2019-11290 Cloud Foundry UAA logs query parameters in tomcat access file

2019-11-2100:00:00

CWE-532

pivotal

www.cve.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

54.0%

JSON

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

CNA Affected

[
  {
    "product": "UAA Release",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "lessThan": "v74.8.0",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]