CVE-2019-3798
Escalation of Privileges in Cloud Controller
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Escalation of Privileges in Cloud Controller
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
- Record
CVE-2019-3798- CVSS 3.0
- 6.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2019-13426
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
- Record
EUVD-2019-13426- CVSS 3.0
- 6.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9hx4-42jp-5rgc
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper...
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
- Record
GHSA-9hx4-42jp-5rgc- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
- Record
CVE-2019-3798- CVSS 3.0
- 6.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
- Record
CVE-2019-3798- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3798 is a medium vulnerability (CVSS 6.0) in Cloud Foundry Capi-release, published April 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. No source names a fixed version.