CVE-2019-3787
High
Description
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
SeverityHigh
CVSS8.3
Exploit probability—
ProductPivotal Software Cloud Foundry Uaa-release
PublishedJun 19, 2019
First seenJun 19, 2019
Weakness typeCWE-840CWE-840
How to fix
Update
- pivotal_software cloud_foundry_uaa-release73.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software cloud_foundry_uaa-release | v < 73.0.0 | 73.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.