Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2019-11293

UAA logs all query parameters with debug logging level

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
pivotal

Description

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cloud Foundry UAA Release

  • All to < v74.10.0affected

References