Lucene search

DellCVELIST:CVE-2019-3777

HistoryMar 07, 2019 - 7:00 p.m.

CVE-2019-3777 Apps Manager unverified SSL certs in Cloud Controller proxy

2019-03-0719:00:00

CWE-295

dell

www.cve.org

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

AI Score

9.4

Confidence

High

EPSS

0.004

Percentile

73.4%

JSON

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller’s DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user’s resources in the Cloud Controller

CNA Affected

[
  {
    "product": "Apps Manager",
    "vendor": "Pivotal",
    "versions": [
      {
        "lessThan": "666.0.19",
        "status": "affected",
        "version": "666",
        "versionType": "custom"
      },
      {
        "lessThan": "665.0.26",
        "status": "affected",
        "version": "665",
        "versionType": "custom"
      },
      {
        "lessThan": "667.0.5",
        "status": "affected",
        "version": "667",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Pivotal Application Service",
    "vendor": "Pivotal",
    "versions": [
      {
        "lessThan": "2.4.3",
        "status": "affected",
        "version": "2.4",
        "versionType": "custom"
      },
      {
        "lessThan": "2.3.7",
        "status": "affected",
        "version": "2.3",
        "versionType": "custom"
      },
      {
        "lessThan": "2.2.12",
        "status": "affected",
        "version": "2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107214

pivotal.io/security/cve-2019-3777

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

AI Score

9.4

Confidence

High

EPSS

0.004

Percentile

73.4%

JSON

Related for CVELIST:CVE-2019-3777