Vulnerability Description
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Cloud Foundry Uaa-Release | < 73.0.0 |
Related Weaknesses (CWE)
References
- https://www.cloudfoundry.org/blog/cve-2019-3787Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2019-3787Vendor Advisory
FAQ
What is CVE-2019-3787?
CVE-2019-3787 is a vulnerability with a CVSS score of 8.3 (HIGH). Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is ...
How severe is CVE-2019-3787?
CVE-2019-3787 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3787?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Cloud Foundry Uaa-Release.