CVE-2019-11293

2019-12-0620:15:09

Google

osv.dev

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.0%

JSON

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.

CPENameOperatorVersion
cf-deploymenteq1.2.3
cf-deploymenteq1.10.0
cf-deploymenteq0.20.0
cf-deploymenteq5.2.0
cf-deploymenteq0.5.0
cf-deploymenteq1.36.0
cf-deploymenteq5.4.0
cf-deploymenteq4.13.3
cf-deploymenteq7.2.0
cf-deploymenteq6.4.0

Name	Operator	Version
cf-deployment	eq	1.2.3
cf-deployment	eq	1.10.0
cf-deployment	eq	0.20.0
cf-deployment	eq	5.2.0
cf-deployment	eq	0.5.0
cf-deployment	eq	1.36.0
cf-deployment	eq	5.4.0
cf-deployment	eq	4.13.3
cf-deployment	eq	7.2.0
cf-deployment	eq	6.4.0