← CVE Intelligence

CVE-2019-11279

Privilege Escalation via Scope Manipulation in UAA PUBLISHED

Description (CNA)

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.

Affected (CNA)

Vendor / productVersions
Cloud Foundry / UAA Release (OSS)affected prior to 74.1.0

CWE

CWE-77

References

ADP enrichment

CVE

No English description supplied.