CVE-2019-11290

7.5 highEPSS 1.3%

High (7.5) in cloudfoundry. EPSS 1.3% chance of exploitation in the next 30 days.

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-532
Published: 2019-11-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cloudfoundry:cf-deployment
cloudfoundry:user_account_and_authentication

References

https://www.cloudfoundry.org/blog/cve-2019-11290
https://www.cloudfoundry.org/blog/cve-2019-11290

Check your stack JSON