CVE-2019-11278

8.8 highEPSS 1.3%

High (8.8) in cloudfoundry user account and authentication. EPSS 1.3% chance of exploitation in the next 30 days.

CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2019-09-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cloudfoundry:user_account_and_authentication

References

https://www.cloudfoundry.org/blog/cve-2019-11278
https://www.cloudfoundry.org/blog/cve-2019-11278

Check your stack JSON