CVE-2019-3788highCWE-601

CVE-2019-3788: falha de alta gravidade em Cloud Foundry UAA Release (OSS)

UAA redirect-uri allows wildcard in the subdomain

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar UAA+ Monitorar Pivotal Application Service

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.8%
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
Cloud Foundry · UAA Release (OSS)Pivotal · Pivotal Application Service
CVEs relacionadas — Cloud Foundry UAA Release (OSS)

No mesmo produto, das mais perigosas para as menos.

CVE-2019-3777HIGHApps Manager unverified SSL certs in Cloud Controller proxyEPSS 1.9%CVE-2019-11278HIGHPrivilege Escalation via Blind SCIM Injection in UAAEPSS 1.3%CVE-2019-11279HIGHPrivilege Escalation via Scope Manipulation in UAAEPSS 1.3%CVE-2018-1278—CVE-2018-1278EPSS 1.2%CVE-2019-11270HIGHUAA clients.write vulnerabilityEPSS 1.1%CVE-2019-3787HIGHUAA defaults email address to an insecure domainEPSS 1.1%