Intel

CVE-2019-3788

uaa_release: URL Redirection to Untrusted Site ('Open Redirect') (CVE-2019-3788)

highEPSS 0.8%

Description

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.

Source: CVELISTV5NVD

Metrics

Severity
high
Priority score
76.66
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
8.7
Source: cna-v3
CVSS v3
8.7
CVSS v4
—
EPSS percentile
55.5 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.8 %
Low — model estimates < 1% exploitation likelihood.
Published
2019-04-25 20:17 UTC
CWE
CWE-601

Weakness classes (CWE)

  • CWE-601Base

    URL Redirection to Untrusted Site ('Open Redirect')

    The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cloudfoundry

    uaa_release71.0

References & sources

IDCVE-2019-3788