VYPR
← All advisories
High severity7.5NVD Advisory· Published Aug 5, 2019· Updated Jun 17, 2026

CVE-2019-11270

CVE-2019-11270

Description

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Cloudfoundry/Application Service
    cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:*
    Range: >=2.3.0,<2.3.15
  • Cloudfoundry/Uaa2 versions
    cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*range: <73.4.0
    • (no CPE)range: <v73.4.0
  • Cloudfoundry/Operations Manager
    cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*
    Range: >=2.3.0,<2.3.22
  • Cloudfoundry/Cloud Foundryllm-fuzzy
    Range: <v73.4.0
  • Cloud Foundry/UAA Release (OSS)v5
    Range: prior to v73.4.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.