CVE-2019-11270CWE-269

UAA clients.write vulnerability

High · published August 5, 2019

CVSS v3.0
7.3
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01119 · 65.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2019-08-05T16:21Z
EPSS history
Timeline
  • 05 AUG 16:21Z
    UAA clients.write vulnerability
    cvelistv5