← CVE Intelligence

CVE-2019-11278

Privilege Escalation via Blind SCIM Injection in UAA PUBLISHED

Description (CNA)

CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.

Affected (CNA)

Vendor / productVersions
Cloud Foundry / UAA Release (OSS)affected prior to 74.1.0

CWE

CWE-77

References

ADP enrichment

CVE

No English description supplied.