CVE-2019-11270

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0

Description The issue allows a malicious client with the clients.write authority or scope to bypass restrictions and create clients with arbitrary scopes that the creator does not possess. This can lead to privilege escalation.

Recommendations For Cloud Foundry UAA versions prior to 73.4.0, update to version 73.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the clients.write authority or scope to minimize the risk of exploitation. Restrict access to client creation via clients.write to prevent malicious clients from bypassing restrictions.