507 matches found
Design/Logic Flaw
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of...
CVE-2019-11278 Privilege Escalation via Blind SCIM Injection in UAA
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of...
CVE-2019-11278
CVE-2019-11278 affects Cloud Foundry UAA before 74.1.0. A remote attacker with the privileges client.write and groups.update can craft a SCIM query by injecting external input directly into SCIM, causing a leak of information that enables privilege escalation and potential control of UAA scopes. ...
Privilege Escalation
cloudfoundry-identity-server is vulnerable to privilege escalation. External input is directly appended to an SCIM query, allowing a remote attacker with client.write and groups.update to inject and execute a malicious SCIM query. This allows the retrieval of confidential information that allows ...
CVE-2019-11278: Privilege Escalation via Blind SCIM Injection in UAA | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA Release All versions prior to v74.1.0 Description CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with ‘client.write’ and ‘groups.update’ ca...
Cloud Foundry UAA CVE-2019-11279 Privilege Escalation Vulnerability
Description Cloud Foundry UAA is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to to gain elevated privileges. Versions prior to Cloud Foundry UAA 74.1.0 are vulnerable. Technologies Affected Pivotal Cloud Foundry UAA 60.0 Pivotal Cloud Foundry UAA 61.0 Pivotal...
CVE-2019-11279: Privilege Escalation via Scope Manipulation in UAA | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA Release All versions prior to v74.1.0 Description CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn’t be allowed by submitting an array of requested scopes. A remote malicious...
CVE-2019-11274
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute...
CVE-2019-11274
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute...
Design/Logic Flaw
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute...
CVE-2019-11274 UAA SCIM Filter XSS
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute...
CVE-2019-11274
Summary: CVE-2019-11274 affects Cloud Foundry UAA prior to v74.0.0, enabling a remote, unauthenticated attacker to craft a URL containing a SCIM filter that can execute malicious JavaScript (XSS) in older browsers. The root cause is insufficient sanitization of SCIM filter handling in UAA. Impact...
CVE-2019-11274: UAA SCIM Filter XSS | Cloud Foundry
Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA Release OSS All versions prior to v74.0.0 Description Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that...
CVE-2019-11270
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
CVE-2019-11270
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
Design/Logic Flaw
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
CVE-2019-11270 UAA clients.write vulnerability
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
CVE-2019-11270
Cloud Foundry UAA before v73.4.0 is affected. A malicious client with the clients.write authority can bypass restrictions on clients created via clients.write and create clients with arbitrary scopes the creator does not possess. Affected product: Cloud Foundry UAA (OSS) prior to v73.4.0. Impact:...
CVE-2019-11270: UAA clients.write vulnerability | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients wi...