CVE-2019-3775 High · 7.1 EPSS 0.9%
UAA allows users to modify their own email address
Cloud Foundry · UAA Release (OSS)
Official description · CVE.org
Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
16.8 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 7 Mar 2019. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 1PersistenceTA0003
MITRE CTID mapping of the CVE · primary impact
Detection
0 rules for this CVE · 35 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-3775 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Account ManipulationT109835 general rules
- Password Change on Directory Service Restore Mode (DSRM) Accounthighstable
- Active Directory User Backdoorshightest
- Anomalous User Activityhightest
- AWS User Login Profile Was Modifiedhightest
- Bulk Deletion Changes To Privileged Account Permissionshightest
- Cisco Local Accountshightest
- Enabled User Right in AD to Control User Objectshightest
- ESXi Admin Permission Assigned To Account Via ESXCLIhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.