Security readout for executives and security teams
Plain-English summary
Cloud Foundry UAA before 73.0.0 could create a fallback email address at unknown.org when a user had no email and a username without @. Because that domain is privately controlled, password recovery mail could go outside the organization, creating a path to full account takeover.
Executive priority
Treat this as a high-priority identity risk for Cloud Foundry environments. The business concern is unauthorized account control, not service disruption alone. Prioritize version verification and account-data cleanup.
Technical view
The flaw is an insecure default in Cloud Foundry UAA email handling. Missing email values could be synthesized by appending unknown.org to non-email usernames. The CVSS 3.0 score is 8.3, with high impact to confidentiality, integrity, and availability, but high attack complexity and required user interaction.
Likely exposure
Exposure is most likely in Cloud Foundry deployments running UAA releases earlier than 73.0.0, especially where users may exist without explicit email addresses and account recovery is enabled.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The stated risk is account takeover through recovery emails sent to a domain not controlled by the affected organization.
Researcher notes
CWE-840 is listed. The practical attack surface depends on UAA version, user records, and recovery workflow behavior. Evidence is sufficient for exposure triage, but the bundle does not provide active exploitation or detailed patch notes.
Mitigation direction
- Upgrade Cloud Foundry UAA to version 73.0.0 or later.
- Review Cloud Foundry advisory guidance before applying production changes.
- Ensure every user account has a valid, organization-controlled email address.
- Disable or restrict password recovery until affected accounts are corrected.
- Monitor for recovery emails involving unknown.org addresses.
Validation and detection
- Inventory deployed Cloud Foundry UAA release versions.
- Find accounts missing email addresses or using usernames without @.
- Check whether any generated account email ends in unknown.org.
- Review password recovery logs for suspicious unknown.org destinations.
- Confirm recovery emails only target verified controlled addresses after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-840: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-3787 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H1.66Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.3HighVector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cloudfoundry.org/blog/cve-2019-3787CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Business Logic Errors
Business Logic Errors represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.