CVE-2019-11270 HIGH

CVE-2019-11270: UAA clients.write vulnerability

Vendor Cloud Foundry

Product UAA Release (OSS)

Weakness CWE-269

Published August 5, 2019

Last update September 17, 2024

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.

Key dates

02Disclosure timeline

August 5, 2019 CVE published

September 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-11270 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/269.html

Related vulnerabilities

04Related CVE

CVE-2025-26396 SolarWinds Dameware Mini Remote Control Service Incorrect Permissions Local Privilege Escalation Vulnerability CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write CVE-2025-21199 Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability CVE-2026-0920 LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter CVE-2022-1606 Incorrect privilege assignment in M-Files Server