CVE-2019-11282

MEDIUM

Cloudfoundry Cf-deployment < 12.2.0 - Information Disclosure

Title source: rule
STIX 2.1

Description

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.cloudfoundry.org/blog/cve-2019-11282

Scores

CVSS v3 4.3
EPSS 0.0114
EPSS Percentile 62.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200 CWE-74
Status published
Products (2)
cloudfoundry/cf-deployment < 12.2.0
pivotal_software/cloud_foundry_uaa < 74.3.0
Published Oct 23, 2019
Tracked Since Feb 18, 2026