PT-2019-16724 · Cloud Foundry · Cloud Foundry Uaa

Published 2019-07-18 · Updated 2020-10-16 · CVE-2019-3794

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0

Description The issue allows a remote user to perform clickjacking attacks on UAA's frontend sites due to the absence of an X-FRAME-OPTIONS header on various endpoints.

Recommendations For versions prior to 73.4.0, update to version 73.4.0 or later to resolve the issue. As a temporary workaround, consider configuring the X-FRAME-OPTIONS header manually to prevent clickjacking attacks until a patch is applied.

Fix

Improper Access Control

Clickjacking

Weakness Enumeration

CWE-284

CWE-1021

Related Identifiers

CVE-2019-3794

Affected Products

Cloud Foundry Uaa

References · 4

• https://cloudfoundry.org/blog/cve-2019-3794 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3794 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3794 · Note