CVE-2019-3798
MEDIUMCloud Foundry CAPI Release < 1.79.0 - Authenticated Privilege Escalation via UAA Client Name Spoofing
Title source: llmDescription
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.cloudfoundry.org/blog/cve-2019-3798
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/108095
Scores
CVSS v3
6.0
EPSS
0.0137
EPSS Percentile
68.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
Details
CWE
CWE-287
Status
published
Products (1)
cloudfoundry/capi-release
< 1.79.0
Published
Apr 17, 2019
Tracked Since
Feb 18, 2026