PT-2019-16727 · Cloud Foundry · Cloud Foundry Cloud Controller

Publicado 2019-04-17 · Atualizado 2019-10-09 · CVE-2019-3798

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller API Release versions prior to 1.79.0

Description The issue concerns improper authentication in the validation of user permissions. A remote authenticated malicious user, with the ability to create UAA clients and knowledge of a victim's email, may escalate their privileges to those of the victim. This is achieved by creating a client with a name equal to the guid of the victim.

Recommendations For versions prior to 1.79.0, update to version 1.79.0 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-3798

Produtos afetados

Cloud Foundry Cloud Controller

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-3798 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3798 · Nota de Segurança
• https://cloudfoundry.org/blog/cve-2019-3798 · Aviso do Fabricante
• http://securityfocus.com/bid/108095 · Nota