What’s Vulnerable › Vulnerabilities

CVE-2019-11290: Cloud Foundry UAA logs query parameters in tomcat access file

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-26 · updated 2026-06-17
• Weakness: CWE-532

Description

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Affected products

• Cloud Foundry cf-deployment: before 12.10.0 — fixed in 12.10.0
• Cloudfoundry User Account And Authentication: before 74.8.0 — fixed in 74.8.0

How to fix

Upgrade to a fixed version: Cloud Foundry cf-deployment 12.10.0; Cloudfoundry User Account And Authentication 74.8.0. Check the vendor advisory for mitigations.

References

• https://www.cloudfoundry.org/blog/cve-2019-11290
• https://www.cloudfoundry.org/blog/cve-2019-11290

Get alerted when CVE-2019-11290 or the next vulnerability affects your stack