High
Cloud Foundry Foundation
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients with arbitrary scopes that the creator does not possess.
Severity is high unless otherwise noted.
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
This issue was responsibly reported by Yuval Avrahami.
2019-08-01: Initial vulnerability report published.
2019-08-09: Updated description for clarity.