{"containers": {"cna": {"affected": [{"product": "UAA Release (OSS)", "vendor": "Cloud Foundry", "versions": [{"lessThan": "v71.0", "status": "affected", "version": "All", "versionType": "custom"}]}, {"product": "Pivotal Application Service", "vendor": "Pivotal", "versions": [{"lessThan": "2.5.1", "status": "affected", "version": "2.5", "versionType": "custom"}]}], "datePublic": "2019-04-15T00:00:00", "descriptions": [{"lang": "en", "value": "Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "CWE-601: Open Redirect", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-04-25T20:17:37", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cloudfoundry.org/blog/cve-2019-3788"}], "source": {"discovery": "UNKNOWN"}, "title": "UAA redirect-uri allows wildcard in the subdomain", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2019-04-15T00:00:00.000Z", "ID": "CVE-2019-3788", "STATE": "PUBLIC", "TITLE": "UAA redirect-uri allows wildcard in the subdomain"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "UAA Release (OSS)", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "All", "version_value": "v71.0"}]}}]}, "vendor_name": "Cloud Foundry"}, {"product": {"product_data": [{"product_name": "Pivotal Application Service", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "2.5", "version_value": "2.5.1"}]}}]}, "vendor_name": "Pivotal"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-601: Open Redirect"}]}]}, "references": {"reference_data": [{"name": "https://www.cloudfoundry.org/blog/cve-2019-3788", "refsource": "CONFIRM", "url": "https://www.cloudfoundry.org/blog/cve-2019-3788"}]}, "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2019-3788", "datePublished": "2019-04-15T00:00:00", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2019-04-25T20:17:37", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudfoundry:uaa_release:*:*:*:*:*:*:*:*", "matchCriteriaId": "8248445F-0199-467C-B07D-E86887EEA946", "versionEndExcluding": "71.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim."}, {"lang": "es", "value": "La versi\u00f3n UAA de Cloud Foundry, en versiones anteriores a la 71.0, permite a los clientes ser configurados con un uri de redirecci\u00f3n inseguro. Dado que un cliente UAA se configur\u00f3 con un comod\u00edn en el subdominio de redirecci\u00f3n de uri, un usuario remoto malicioso no autenticado puede crear un enlace de phishing para obtener un c\u00f3digo de acceso UAA de la v\u00edctima."}], "id": "CVE-2019-3788", "lastModified": "2019-10-09T23:49:39.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2019-04-25T21:29:00.743", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.cloudfoundry.org/blog/cve-2019-3788"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}