CVE-2019-3775

HIGH

Cloud Foundry UAA < 70.0 - Authenticated User Impersonation via Email Address Spoofing

Title source: llm

Description

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.cloudfoundry.org/blog/cve-2019-3775

Scores

CVSS v3 7.1

EPSS 0.0089

EPSS Percentile 54.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N

Details

CWE

CWE-290 CWE-287

Status published

Products (1)

cloudfoundry/uaa_release < 70.0

Published Mar 07, 2019

Tracked Since Feb 18, 2026