CVE-2019-11268: UAA SQL Identity Zone Vulnerability

Severity

Medium

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• Severity is medium unless otherwise noted.
  • UAA Release (OSS) is vulnerable prior to v73.3.0

Description

UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• UAA Release (OSS)
  • Upgrade All versions to v73.3.0 or greater

Credit

This issue was responsibly reported by Yuval Avrahami.

History

2019-06-27: Initial vulnerability report published.