CVE-2019-3786: cloud foundry bosh backup and restore Improper Privilege Management
Vulnerability summary
CVE-2019-3786 is a high (CVSS 7.7) Improper Privilege Management vulnerability in cloud foundry bosh backup and restore. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.7% of scored vulnerabilities.
Timeline
- 24-04-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST7.7HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Affected systems
Cloud foundry1 product
- bosh backup and restore≥ All, < v1.5.0
Cloudfoundry1 product
- bosh_backup_and_restore< 1.5.0
2 vendors · 2 products