PT-2019-16724 · Cloud Foundry · Cloud Foundry Uaa

Publicado 2019-07-18 · Atualizado 2020-10-16 · CVE-2019-3794

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0

Description The issue allows a remote user to perform clickjacking attacks on UAA's frontend sites due to the absence of an X-FRAME-OPTIONS header on various endpoints.

Recommendations For versions prior to 73.4.0, update to version 73.4.0 or later to resolve the issue. As a temporary workaround, consider configuring the X-FRAME-OPTIONS header manually to prevent clickjacking attacks until a patch is applied.

Correção

Improper Access Control

Clickjacking

Enumeração de Fraquezas

CWE-284

CWE-1021

Identificadores relacionados

CVE-2019-3794

Produtos afetados

Cloud Foundry Uaa

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3794 · Nota
• https://cloudfoundry.org/blog/cve-2019-3794 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-3794 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3794 · Nota de Segurança