CVE-2019-11293 — MEDIUM (6.5)

Q: How severe is CVE-2019-11293?

CVE-2019-11293 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2019-11293?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudfoundry Cf-Deployment, Cloudfoundry User Account And Authentication.

Vulnerability Description

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Cloudfoundry	Cf-Deployment	< 12.12.0
Cloudfoundry	User Account And Authentication	< 74.10.0

Related Weaknesses (CWE)

CWE-532

References

https://www.cloudfoundry.org/blog/cve-2019-11293Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2019-11293Vendor Advisory

FAQ

What is CVE-2019-11293?

CVE-2019-11293 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain ...

How severe is CVE-2019-11293?

CVE-2019-11293 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-11293?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudfoundry Cf-Deployment, Cloudfoundry User Account And Authentication.