High
Security advisory
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11290
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:05 UTC · Revision 1
Source evidence
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
osv:CVE-2019-11290
Complete source record
{
"id": "84e3787f5ed54a058ef6f65e4b7905e2af9ee26154413fb943a320836fcd2bbb",
"url": "https://osv.dev/vulnerability/CVE-2019-11290",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11290",
"summary": "Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.",
"evidence": "osv:CVE-2019-11290",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-11290",
"aliases": [
"CVE-2019-11290"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cloudfoundry/cf-deployment",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5352c2bf4b508086379b4b2cd372a6feb71e41b9"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "12.10.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v12.9.0",
"v12.8.0",
"v12.7.0",
"v12.6.0",
"v12.5.0",
"v12.4.0",
"v12.3.0",
"v12.2.0",
"v12.1.0",
"v12.0.0",
"v11.2.0",
"v11.1.0",
"v11.0.0",
"v10.1.0",
"v10.0.0",
"v7.9.0",
"v7.8.0",
"v7.6.0",
"v7.5.0",
"v7.4.0",
"v7.3.0",
"v7.2.0",
"v7.1.0",
"v7.0.0",
"v6.10.0",
"v6.9.0",
"v6.8.0",
"v6.7.0",
"v6.6.0",
"v6.5.0",
"v6.4.0",
"v6.3.0",
"v6.2.0",
"v6.1.0",
"v6.0.0",
"v5.5.0",
"v5.4.0",
"v5.3.0",
"v5.1.0",
"v5.0.0",
"v4.5.0",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.0",
"v4.0.0",
"v3.6.0",
"v3.5.0",
"v3.4.0",
"v3.3.0",
"v3.2.0",
"v3.1.0",
"v3.0.0",
"v2.5.0",
"v2.4.0",
"v2.3.0",
"v2.2.0",
"v2.1.0",
"v2.0.0",
"v1.38.0",
"v1.37.0",
"v1.36.0",
"v1.35.0",
"v1.34.0",
"v1.33.0",
"v1.32.0",
"v1.31.0",
"v1.30.0",
"v1.29.0",
"v1.28.0",
"v1.27.0",
"v1.26.0",
"v1.25.0",
"v1.24.0",
"v1.23.0",
"v1.22.0",
"v1.21.0",
"v1.20.0",
"v1.19.0",
"v1.18.0",
"v1.16.0",
"v1.17.0",
"v1.15.0",
"v1.14.0",
"v1.13.0",
"v1.12.0",
"v1.11.0",
"v1.10.0",
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.0",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.0",
"v0.37.0",
"v1.0.0",
"v0.36.0",
"v0.35.0",
"v0.34.0",
"v0.33.0",
"v0.32.0",
"v0.31.0",
"v0.30.0",
"v0.28.0",
"v0.29.0",
"v0.15.0",
"v0.13.0",
"v0.14.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.9.1",
"v0.9.0",
"v0.8.0",
"v0.3.0",
"v0.7.0",
"v0.5.0",
"v0.2.1",
"v0.2.2",
"v0.2.0",
"v0.1.0",
"v0.0.2",
"v0.0.1",
"v0.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11290.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/cloudfoundry/uaa",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0c35faeee660ed1cebd137427cf6d34e0939394f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "74.8.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v74.7.0",
"v74.6.0",
"v74.5.0",
"v74.4.0",
"v74.3.0",
"v74.2.0",
"v74.1.0",
"v74.0.0",
"v73.7.0",
"4.35.0",
"4.31.0",
"4.30.0",
"4.29.0",
"4.28.0",
"4.27.0",
"4.26.0",
"4.25.0",
"4.24.0",
"4.23.0",
"4.22.0",
"4.19.0",
"4.21.0",
"4.20.0",
"4.18.0",
"4.17.0",
"4.16.0",
"releases/4.15.0",
"4.15.0",
"4.12.0",
"4.11.0",
"4.10.0",
"4.9.0",
"travis-success-1497",
"travis-success-1478",
"travis-success-1475",
"1.8.0",
"1.6.2",
"1.6.1",
"1.5.4.1",
"1.5.4",
"1.5.3",
"1.5.2.1",
"1.5.2",
"1.5.0",
"1.4.7",
"1.4.6",
"1.4.5",
"1.4.3",
"1.4.2",
"1.4.1",
"1.4.0",
"1.2.6",
"1.2.0",
"1.1.2",
"1.1.1",
"1.1",
"1.0.3",
"1.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11290.json"
}
}
],
"modified": "2026-10-24T10:30:24.361426109Z",
"provider": "osv",
"references": [
"https://www.cloudfoundry.org/blog/cve-2019-11290"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-11290",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431129,
"published_at": "2019-11-26T00:15:11.547+00:00"
}