PT-2019-16727
CVE-2019-3798
·
تاريخ النشر
2019-04-17
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Cloud Foundry Cloud Controller API Release versions prior to 1.79.0
Description
The issue concerns improper authentication in the validation of user permissions. A remote authenticated malicious user, with the ability to create UAA clients and knowledge of a victim's email, may escalate their privileges to those of the victim. This is achieved by creating a client with a name equal to the guid of the victim.
Recommendations
For versions prior to 1.79.0, update to version 1.79.0 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾