CVE-2019-11282: Cloudfoundry Cf-Deployment

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

Affected products

• Cloudfoundry Cf-Deployment: before 12.2.0 (fixed in 12.2.0)
• Pivotal Software Cloud Foundry Uaa: before 74.3.0 (fixed in 74.3.0)

Published 2019-10-23. Last modified 2026-06-17.