Security readout for executives and security teams
Plain-English summary
This flaw lets a poorly configured Cloud Foundry UAA OAuth client accept unsafe redirect destinations. If a client used a wildcard in a redirect URI subdomain, an attacker could lure a user with a phishing link and obtain that user’s UAA access code.
Executive priority
Treat as high priority for Cloud Foundry environments using UAA OAuth clients. Business risk is account access compromise through phishing, but urgency depends on whether vulnerable wildcard redirect configurations exist.
Technical view
CVE-2019-3788 is a CWE-601 redirect weakness in Cloud Foundry UAA before release 71.0. The risky condition is a UAA client configured with a wildcard in the redirect URI subdomain, allowing unauthenticated remote phishing to capture an authorization code. CVSS is 8.7 high.
Likely exposure
Exposure is limited to Cloud Foundry UAA before 71.0 and Pivotal Application Service 2.5 where clients use wildcard subdomain redirect URIs. Deployments without that client configuration may not be practically exposed.
Exploitation context
The bundle does not cite active exploitation, and CISA KEV is false. The described attack is phishing-based and depends on a vulnerable redirect URI configuration that can leak a UAA access code.
Researcher notes
Key evidence points to redirect URI validation/configuration risk, not a general remote code execution issue. Confirm version, client configuration, and PAS 2.5 applicability before scoping impact. No source in the bundle confirms exploitation in the wild.
Mitigation direction
- Upgrade Cloud Foundry UAA to release 71.0 or later.
- Review Cloud Foundry guidance for PAS 2.5 remediation details.
- Remove wildcard subdomain redirect URIs from UAA client registrations.
- Use exact, trusted redirect URIs for OAuth clients.
- Check vendor guidance before applying product-specific workarounds.
Validation and detection
- Inventory UAA release versions across Cloud Foundry foundations.
- List UAA clients and inspect registered redirect URIs.
- Flag redirect URIs with wildcards in subdomains.
- Confirm OAuth clients use exact trusted redirect destinations.
- Review authentication logs for suspicious authorization-code activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-601: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-3788 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N2.25.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.7HighVector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cloudfoundry.org/blog/cve-2019-3788CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
URL Redirection to Untrusted Site ('Open Redirect')
URL Redirection to Untrusted Site ('Open Redirect') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.