CVE-2019-11282

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 74.3.0

Description The issue concerns an endpoint vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content, potentially leaking information about users of the UAA.

Recommendations For versions prior to 74.3.0, update to version 74.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the scim.invite scope to minimize the risk of exploitation.