CVE-2019-3788: UAA redirect-uri allows wildcard in the subdomain
Cloud Foundry · UAA Release (OSS)
Vendor fix available · Affected: Cloud Foundry UAA Release (OSS) · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 58% of scored CVEs
DescriptionCVE.org
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Cloud Foundry · UAA Release (OSS)from All before v71.0
- Pivotal · Pivotal Application Servicefrom 2.5 before 2.5.1
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Open Redirect
- Vendor
- Cloud Foundry
- Published
- April 2019
CoverageNo articles yet
No CyberSIXT article names CVE-2019-3788 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.