CVE-2019-11270: UAA clients.write vulnerability

Severity

High

Vendor

Cloud Foundry Foundation

Description

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients with arbitrary scopes that the creator does not possess.

Affected Cloud Foundry Products and Versions

Severity is high unless otherwise noted.

• UAA Release (OSS)
  • All versions prior to v73.4.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• UAA Release (OSS)
  • Upgrade All versions to v73.4.0 or greater

Credit

This issue was responsibly reported by Yuval Avrahami.

History

2019-08-01: Initial vulnerability report published.

2019-08-09: Updated description for clarity.