CVE-2019-11290CWE-532

Cloud Foundry UAA logs query parameters in tomcat access file

High · published November 25, 2019

CVSS v3.0
8.8
EPSS
1%
Percentile
69.7
In the wild
Unconfirmed
What it is

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01277 · 69.7th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2019-11-25T23:56Z
EPSS history
Timeline
  • 25 NOV 23:56Z
    Cloud Foundry UAA logs query parameters in tomcat access file
    cvelistv5