CVE-2019-11270: UAA clients.write vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-05 · updated 2026-06-17
Weakness: CWE-269

Description

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.

Affected products

Pivotal Software Application Service: from 2.3.0 before 2.3.15; from 2.4.0 before 2.4.11; from 2.5.0 before 2.5.7; from 2.6.0 before 2.6.2 — fixed in 2.3.15, 2.4.11, 2.5.7, 2.6.2
Cloud Foundry UAA: before 73.4.0 — fixed in 73.4.0
Pivotal Ops Manager: from 2.3.0 before 2.3.22; from 2.4.0 before 2.4.16; from 2.5.0 before 2.5.10; from 2.6.0 before 2.6.4 — fixed in 2.3.22, 2.4.16, 2.5.10, 2.6.4

How to fix

Upgrade to a fixed version: Pivotal Software Application Service 2.3.15, 2.4.11, 2.5.7, 2.6.2; Cloud Foundry UAA 73.4.0; Pivotal Ops Manager 2.3.22, 2.4.16, 2.5.10, 2.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-11270 or the next vulnerability affects your stack