Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2019-11270: Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'c

48
This month
HIGH 7.5REMOTEUPGRADEUPGRADEUPGRADE

CVE-2019-11270 is a high-severity flaw (CVSS 7.5) affecting application service, cloud foundry uaa, operations manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance1.1% (top 34%)
CISA exploited listNo
WeaknessCWE-269, CWE-732
Published2019-08-05
Last modified2026-06-17
Publisher (CNA): Pivotal Software, Inc. · Vendor: pivotal software

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

pivotal software application service UPGRADE
Affected: >= 2.3.0 and < 2.3.15 · >= 2.4.0 and < 2.4.11 · >= 2.5.0 and < 2.5.7 · >= 2.6.0 and < 2.6.2
Fixed in: 2.3.15, 2.4.11, 2.5.7, 2.6.2
Safe to downgrade to: a release before 2.3.0
1. Check installed version
apt-cache policy application-service || rpm -q application-service || application-service --version
2. UPGRADE to 2.3.15 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade application-service
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade application-service
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.3.0 (Debian / Ubuntu)
apt-cache madison application-service sudo apt install application-service=<VERSION_BEFORE_2.3.0> sudo apt-mark hold application-service
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list application-service sudo dnf downgrade application-service-<VERSION_BEFORE_2.3.0> sudo dnf versionlock add application-service
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
pivotal software cloud foundry uaa UPGRADE
Affected: < 73.4.0
Fixed in: 73.4.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy cloud-foundry-uaa || rpm -q cloud-foundry-uaa || cloud-foundry-uaa --version
2. UPGRADE to 73.4.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cloud-foundry-uaa
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cloud-foundry-uaa
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
pivotal software operations manager UPGRADE
Affected: >= 2.3.0 and < 2.3.22 · >= 2.4.0 and < 2.4.16 · >= 2.5.0 and < 2.5.10 · >= 2.6.0 and < 2.6.4
Fixed in: 2.3.22, 2.4.16, 2.5.10, 2.6.4
Safe to downgrade to: a release before 2.3.0
1. Check installed version
apt-cache policy operations-manager || rpm -q operations-manager || operations-manager --version
2. UPGRADE to 2.3.22 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade operations-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade operations-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.3.0 (Debian / Ubuntu)
apt-cache madison operations-manager sudo apt install operations-manager=<VERSION_BEFORE_2.3.0> sudo apt-mark hold operations-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list operations-manager sudo dnf downgrade operations-manager-<VERSION_BEFORE_2.3.0> sudo dnf versionlock add operations-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-11270?

application service: upgrade to 2.3.15, 2.4.11, 2.5.7, 2.6.2; cloud foundry uaa: upgrade to 73.4.0; operations manager: upgrade to 2.3.22, 2.4.16, 2.5.10, 2.6.4. Exact commands for each OS are on this page.

Is CVE-2019-11270 being exploited?

CVE-2019-11270 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-11270 affect?

CVE-2019-11270 affects application service, cloud foundry uaa, operations manager. Severity is high (CVSS 7.5). Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients wit

How urgent is CVE-2019-11270?

Priority 48/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.