Cross site request forgery (csrf)

2019-09-2622:15:00

PRIOn knowledge base

www.prio-n.com

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn’t be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.

CPENameOperatorVersion
uaa_releaselt74.1.0

CPE	Name	Operator	Version
	uaa_release	lt	74.1.0

References

www.cloudfoundry.org/blog/cve-2019-11279