Skip to main content

Uaa Release CVE-2019-11279

HIGH
Command Injection (CWE-77)
2019-09-26 security@pivotal.io
Command Injection Uaa Release
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 26, 2019 - 22:15 nvd
HIGH 8.8

DescriptionNVD

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.

AnalysisAI

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls. Affected products include: Cloudfoundry Uaa Release. Version information: prior to 74.1.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.

More in Uaa Release

View all
CVE-2026-40965 CRITICAL
10.0 Jun 01

Private key disclosure in Cloud Foundry UAA versions v76.12.0 through v78.12.0 allows unauthenticated remote attackers t
CVE-2019-3801 CRITICAL
9.8 Apr 25

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fet
CVE-2016-0732 HIGH
8.8 Sep 07

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 th
CVE-2026-22723 MEDIUM
6.5 Mar 05

Cloudfoundry UAA versions 77.30.0 through 78.7.0 and Cloudfoundry Deployment versions 48.7.0 through 54.10.0 contain a l
CVE-2019-3775 MEDIUM
6.5 Mar 07

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. Rated medium severity (CVSS
CVE-2019-3788 MEDIUM
6.1 Apr 25

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Rated

CVE-2017-8031 MEDIUM
5.3 Nov 27

An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior
CVE-2025-22246 LOW
3.0 May 13

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. Rated low

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8
CVE-2025-10035 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2019-11279 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy