CVE-2019-3788

    Dashboard / Vulnerabilities / CVE-2019-3788

    CVE-2019-3788

    Published: 25 Apr 2019Last Modified: 8 Jul 2026

    Summary:

    Details: Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.

    References: https://www.cloudfoundry.org/blog/cve-2019-3788

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a26e64f024d2e98d94858b0d9ce76563e77d724a

    Affected versions

    v70.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High