Escalation of Privileges in Cloud Controller
CVE-2019-3798

6MEDIUM

Key Information:

Vendor

Cloud Foundry

Status
Capi-release
Vendor
CVE Published:
17 April 2019

What is CVE-2019-3798?

Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.

Affected Version(s)

CAPI-release All < 1.79.0

References

https://www.cloudfoundry.org/blog/cve-2019-3798
x_refsource_CONFIRM
http://www.securityfocus.com/bid/108095
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.