CVE-2019-11278 — Privilege Escalation via Blind SCIM Injection in UAA
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, whi…
Published: 2019-09-26 · CVSS: 8.7 · CVSS 3.0
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7