CVE-2019-3775

uaa_release: Authentication Bypass by Spoofing (CVE-2019-3775)

Description

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

Source: CVELISTV5 NVD

Metrics

Severity

high

69.63

—

no public PoC known

7.1

Source: cna-v3

CVSS v3

7.1

CVSS v4

—

EPSS percentile

56.9 %

High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).

EPSS score

0.9 %

Low — model estimates < 1% exploitation likelihood.

Published

2019-03-07 19:00 UTC

CWE

CWE-290

Weakness classes (CWE)

CWE-290Base
Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

cloudfoundry
uaa_release70.0

References & sources

https://www.cloudfoundry.org/blog/cve-2019-3775
x_refsource_CONFIRM

IDCVE-2019-3775