CVE-2019-11282

2019-10-2316:15:11

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

34.4%

JSON

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

CPENameOperatorVersion
cf-deploymenteq0.20.0
cf-deploymenteq1.36.0
cf-deploymenteq4.13.3
cf-deploymenteq6.4.0
cf-deploymenteq9.0.0
cf-deploymenteq6.2.0
cf-deploymenteq12.1.0
cf-deploymenteq0.36.0
cf-deploymenteq1.7.2
cf-deploymenteq4.18.0

Name	Operator	Version
cf-deployment	eq	0.20.0
cf-deployment	eq	1.36.0
cf-deployment	eq	4.13.3
cf-deployment	eq	6.4.0
cf-deployment	eq	9.0.0
cf-deployment	eq	6.2.0
cf-deployment	eq	12.1.0
cf-deployment	eq	0.36.0
cf-deployment	eq	1.7.2
cf-deployment	eq	4.18.0