Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2019-3786

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2019-3786
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 06:16 UTC · Revision 1

Source evidence

CVE-2019-3786

core-osv · Original source

Published 24 Apr 2019, 16:29 UTC

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.

osv:CVE-2019-3786
Complete source record
{
  "id": "eed079c7553885e6be344665081d02863aa3533600dc4aa4fd94e09f0726f6da",
  "url": "https://osv.dev/vulnerability/CVE-2019-3786",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2019-3786",
    "summary": "Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.",
    "evidence": "osv:CVE-2019-3786",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2019-3786",
      "aliases": [
        "CVE-2019-3786"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/cloudfoundry/bosh-backup-and-restore",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "03a5a1bfb128772ea16f4fc0125cd2333805000b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:cloudfoundry:bosh_backup_and_restore:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.5.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.4.0",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.8",
            "v1.2.7",
            "v1.2.6",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.6",
            "v1.1.5",
            "v1.1.4",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.1.0-alpha",
            "v1.0.0",
            "v1.0.0-beta.4",
            "v0.1.2",
            "1.0-beta.1.3",
            "v0.1.1-rc.11",
            "v0.1.0-rc.254",
            "v0.1.0-rc.253",
            "v0.1.0-rc.252",
            "v0.1.0-rc.251",
            "v0.1.0-rc.250",
            "v0.1.0-rc.249",
            "v0.1.0-rc.248",
            "v0.1.0-rc.247",
            "v0.1.0-rc.246",
            "v0.1.0-rc.245",
            "v0.1.0-rc.244",
            "v0.1.0-rc.243",
            "v0.1.0-rc.242",
            "v0.1.0-rc.241",
            "v0.1.0-rc.240",
            "v0.1.0-rc.239",
            "v0.1.0-rc.238",
            "v0.1.0-rc.237",
            "v0.1.0-rc.236",
            "v0.1.0-rc.235",
            "v0.1.0-rc.234",
            "v0.1.0-rc.233",
            "v0.1.0-rc.232",
            "v0.1.0-rc.231",
            "v0.1.0-rc.230",
            "v0.1.0-rc.229",
            "v0.1.0-rc.228",
            "v0.1.0-rc.227",
            "v0.1.0-rc.226",
            "v0.1.0-rc.225",
            "v0.1.0-rc.224",
            "v0.1.0-rc.223",
            "v0.1.0-rc.222",
            "v0.1.0-rc.221",
            "v0.1.0-rc.220",
            "v0.1.0-rc.219"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3786.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:37.577799207Z",
      "provider": "osv",
      "references": [
        "https://www.cloudfoundry.org/blog/cve-2019-3786"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2019-3786",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 434252,
  "published_at": "2019-04-24T16:29:01.92+00:00"
}