Skip to content
OpenAdvisories
Medium · 4.3 CVE-2019-11282 EUVD-2019-2970GHSA-9jcx-c729-r5q2

UAA is vulnerable to a Blind SCIM injection leading to information disclosure

Published Oct 23, 2019 · Updated Sep 16, 2024 · Assigned by pivotal

Description

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

Affected products

VendorProductAffectedFixed
Cloud Foundry UAA Release All – < v74.3.0 v74.3.0
Cloud Foundry CF Deployment All – < v12.2.0 v12.2.0

References