CVE-2019-11282 — MEDIUM (4.3)

Q: How severe is CVE-2019-11282?

CVE-2019-11282 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2019-11282?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudfoundry Cf-Deployment, Pivotal Software Cloud Foundry Uaa.

Vulnerability Description

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Cloudfoundry	Cf-Deployment	< 12.2.0
Pivotal Software	Cloud Foundry Uaa	< 74.3.0

Related Weaknesses (CWE)

CWE-74 CWE-200

References

https://www.cloudfoundry.org/blog/cve-2019-11282Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2019-11282Vendor Advisory

FAQ

What is CVE-2019-11282?

CVE-2019-11282 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with ma...

How severe is CVE-2019-11282?

CVE-2019-11282 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-11282?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudfoundry Cf-Deployment, Pivotal Software Cloud Foundry Uaa.