Intel

CVE-2019-3798

capi-release: Improper Authentication (CVE-2019-3798)

highEPSS 1.3%

Description

Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.

Source: CVELISTV5NVD

Metrics

Severity
high
Priority score
71.66
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.5
Source: nvd-v3
CVSS v3
6.0
CVSS v4
—
EPSS percentile
69.6 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
1.3 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2019-04-17 13:32 UTC
CWE
CWE-287

Weakness classes (CWE)

  • CWE-287Class

    Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cloudfoundry

    capi-release1.79.0

References & sources

IDCVE-2019-3798