Skip to main content

Authentication Bypass by Spoofing

CVE-2019-3775

High
7.1/10

Summary

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-290 - Authentication Bypass by Spoofing

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.

References

Advisory Timeline

  • Published