CVE-2019-11294

Summary: CVE-2019-11294 affects Cloud Foundry Cloud Controller API (CAPI) version 1.88.0, where space developers can list all global service brokers, exposing broker URLs and GUIDs that should be admin-only. The issue is a disclosure/Access Control problem within CAPI, enabling unauthorized visib...

CVE-2019-11282

CVE-2019-11282 affects Cloud Foundry UAA prior to v74.3.0. A remote authenticated attacker with the scim.invite scope can craft requests to an endpoint vulnerable to SCIM injection, potentially leaking information about UAA users. The issue is documented across multiple sources (NVD entry, CNVD/C...

CVE-2020-5418

CVE-2020-5418 affects Cloud Foundry CAPI (Cloud Controller) versions before 1.98.0. Authentication with only cloud_controller.read and no space roles allows listing all droplets across all spaces (should be none). Root cause: insufficient authorization check exposing droplets to users without pro...