CVE-2019-3794 — Improper Access Control in Foundry UAA Release

CWE-284 — Improper Access ControlCWE-1021 — UI Misrepresentation / Clickjacking3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 46.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cloud Foundry UAA ReleasePivotal Software Cloud Foundry UAA
Timeline
PublishedJul 18
Latest updateMay 24

Description

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5cloud_foundry/uaa_releaseAll — v73.4.0

🔴Vulnerability Details

2
GHSA
GHSA-rqq3-c3q5-mfrg: Cloud Foundry UAA, versions prior to v73↗2022-05-24
▶
CVEList
UAA - Login app subject to clickjacking attack↗2019-07-18
▶
CVE-2019-3794 — Improper Access Control | cvebase