CVE-2019-3787: UAA defaults email address to an insecure domain
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3787?
CVE-2019-3787 is a vulnerability in Cloud Foundry UAA versions prior to 73.0.0 that falls back to appending 'unknown.org' to a user's email address when one is not provided and the user name does not contain an @ character.
What is the severity of CVE-2019-3787?
CVE-2019-3787 has a severity level of 8.8 (high).
How does CVE-2019-3787 affect Cloud Foundry UAA?
CVE-2019-3787 affects Cloud Foundry UAA versions prior to 73.0.0 and can lead to attack vectors including password recovery emails being sent to unintended recipients.
How can I fix CVE-2019-3787?
To fix CVE-2019-3787, it is recommended to upgrade Cloud Foundry UAA to version 73.0.0 or later.
Where can I find more information about CVE-2019-3787?
More information about CVE-2019-3787 can be found at the following link: [https://www.cloudfoundry.org/blog/cve-2019-3787](https://www.cloudfoundry.org/blog/cve-2019-3787).