Uaa Release
Approved changes feed: RSS · Atom
cpe:2.3:a:cloud_foundry:uaa_release:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Cloud Foundry (bbc462c7-a964-5178-97e1-18033ab4dbd3) |
|---|---|
| Product | Uaa Release (c821cb4e-1d9c-5082-a22d-19c72d583daf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-11293 |
vulnerable | 2026-06-08 05:12:36.829472 |
UAA logs all query parameters with debug logging level
HIGH (8.8)
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.
Published: 2019-12-06T20:00:17.131Z
Updated: 2024-09-16T17:57:54.838Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11290 |
vulnerable | 2026-06-08 05:12:36.824242 |
Cloud Foundry UAA logs query parameters in tomcat access file
HIGH (8.8)
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Published: 2019-11-25T23:56:17.082Z
Updated: 2024-09-16T21:02:44.357Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11282 |
vulnerable | 2026-06-08 05:12:36.805466 |
UAA is vulnerable to a Blind SCIM injection leading to information disclosure
MEDIUM (4.3)
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.
Published: 2019-10-23T15:28:24.395Z
Updated: 2024-09-16T23:26:37.789Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-15761 |
vulnerable | 2026-06-08 05:11:03.548885 |
UAA Privilege Escalation
CRITICAL (9.9)
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.
Published: 2018-11-19T14:00:00.000Z
Updated: 2024-09-17T00:46:20.654Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-15754 |
vulnerable | 2026-06-08 05:11:03.449940 |
UAA can issue tokens across identity providers if users with matching usernames exist
MEDIUM (4.2)
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
Published: 2018-12-13T22:00:00.000Z
Updated: 2024-09-16T17:24:01.117Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11082 |
vulnerable | 2026-06-08 05:10:37.856452 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.