CVE-2019-3787

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.

• CWE-840
• CWE-640

• https://www.cloudfoundry.org/blog/cve-2019-3787Vendor Advisory
• https://www.cloudfoundry.org/blog/cve-2019-3787Vendor Advisory

Published

Jun 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3781Cloud Foundry CLI, versions prior to v6.43.0, improperly exp…8.8
• CVE-2019-3782Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvert…7.8
• CVE-2019-3783Cloud Foundry Stratos, versions prior to 2.3.0, deploys with…8.8
• CVE-2019-3784Cloud Foundry Stratos, versions prior to 2.3.0, contains an …8.2
• CVE-2019-3785Cloud Foundry Cloud Controller, versions prior to 1.78.0, co…8.1
• CVE-2019-3786Cloud Foundry BOSH Backup and Restore CLI, all versions prio…7.1
• CVE-2019-3788Cloud Foundry UAA Release, versions prior to 71.0, allows cl…8.7
• CVE-2019-3789Cloud Foundry Routing Release, all versions prior to 0.188.0…6.5
• CVE-2019-3790The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3…6.1
• CVE-2019-3791Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-3792Pivotal Concourse version 5.0.0, contains an API that is vul…6.8
• CVE-2019-3793Pivotal Apps Manager Release, versions 665.0.x prior to 665.…9.8