CVE-2019-3775CWE-290

UAA allows users to modify their own email address

High · published March 7, 2019

CVSS v3.0
7.1
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00876 · 58.6th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2019-03-07T19:00Z
EPSS history
Timeline
  • 07 MAR 19:00Z
    UAA allows users to modify their own email address
    cvelistv5