CVE-2019-11290

Cloud Foundry UAA logs query parameters in tomcat access file

State: Published
Severity: 8.8 High
Published: Nov 25, 2019
Updated: Sep 16, 2024
Reserved: Apr 18, 2019

Description

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	pivotal

Weaknesses

CWE-532 Inclusion of Sensitive Information in Log Files

Affected Products

Product	Versions
UAA ReleaseCloud Foundry	All to before v74.8.0Affected

References

https://www.cloudfoundry.org/blog/cve-2019-11290

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.