UAA allows users to modify their own email address
CVE-2019-3775

7.1HIGH

Key Information:

Vendor

Cloud Foundry

Status
Uaa Release (oss)
Vendor
CVE Published:
7 March 2019

What is CVE-2019-3775?

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

Affected Version(s)

UAA Release (OSS) All

References

https://www.cloudfoundry.org/blog/cve-2019-3775
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.