Cloud Foundry Logo
blog single gear
Blog
Security Advisory

CVE-2019-3794: UAA – Login app subject to clickjacking attack

by: July 9, 2019

CVE-2019-3794: UAA – Login app subject to clickjacking attack

Severity

Medium

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

  • Severity is medium unless otherwise noted.
    • UAA Release (OSS) is vulnerable prior to v73.4.0

Description

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA’s frontend sites.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • UAA Release (OSS)
    • Upgrade All versions to v73.4.0 or greater

History

2019-07-09: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES

You Might Also Like

CVE-2020-5416: CF clusters with NGINX in front of them may be vulnerable to DoS
Security Advisory

CVE-2020-5416: CF clusters with NGINX in front of them may be vulnerable to DoS

by Cloud Foundry Foundation Security Team August 13, 2020
CVE-2016-6639: PHP Buildpack exposes .profile file
Security Advisory

CVE-2016-6639: PHP Buildpack exposes .profile file

by Cloud Foundry Foundation Security Team September 9, 2016
CVE-2019-3801: Java Projects using HTTP to fetch dependencies
Security Advisory

CVE-2019-3801: Java Projects using HTTP to fetch dependencies

by Cloud Foundry Foundation Security Team April 25, 2019
This website uses cookies to offer you a better browsing experience. Find out more about how we use cookies and how you can change your settings. Accept