Privilege Escalation via Blind SCIM Injection in UAA

CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.

N/A

在命令中使用的特殊元素转义处理不恰当(命令注入)

Cloud Foundry UAA 输入验证错误漏洞

Cloud Foundry UAA是美国Cloud Foundry基金会的一款应用于CloudFoundry云平台的身份验证和管理服务终端。 Cloud Foundry UAA 74.1.0之前版本中存在安全漏洞。攻击者可通过构建SCIM查询利用该漏洞泄露信息，进而提升权限。

N/A

N/A