Medium severity · published Apr 25, 2019
CVE-2019-3788
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
Uaa Release · Cloudfoundry
before 71.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3788
Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2019-3788
More from Uaa Release
9.8
CVE-2019-3801
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building
8.8
CVE-2019-11279
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes
8.8
CVE-2016-0732
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and…
7.5
CVE-2025-22246
Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs
6.5
CVE-2026-22723
UAA User Token Revocation logic error