CVE-2019-11279 — Privilege Escalation via Scope Manipulation in UAA
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their …
Published: 2019-09-26 · CVSS: 8.7 · CVSS 3.0
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7