CVE-2019-11279

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-11279
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11279.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-11279
Published
2019-09-26T22:15:11.297Z
Modified
2026-07-08T15:54:31.490756Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.

References

Affected packages

Git / github.com/cloudfoundry/uaa-release

Affected ranges

Type
GIT
Repo
https://github.com/cloudfoundry/uaa-release
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
65f366b9bbe2711a7c518cc040b6e56d8b50a383
Database specific 
{
    "cpe": "cpe:2.3:a:cloudfoundry:uaa_release:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "74.1.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other
ci-upgrade
v10
v11
v12
v14
v15
v16
v17
v18
v19
v2
v20
v21
v22
v23
v24
v25
v26
v27
v3
v31
v53
v55
v56
v57
v58
v59
v6
v60
v7
v8
v9
v12.*
v12.3
v61.*
v61.0
v62.*
v62.0
v63.*
v63.0
v64.*
v64.0
v66.*
v66.0
v67.*
v67.0
v68.*
v68.0
v69.*
v69.0
v70.*
v70.0
v71.*
v71.0
v72.*
v72.0
v73.*
v73.0.0
v73.3.0
v73.4.0
v73.7.0
v74.*
v74.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11279.json"