Apps Manager unverified SSL certs in Cloud Controller proxy
CVE-2019-3777

8HIGH

Key Information:

Vendor

Pivotal

Status
Apps Manager
Pivotal Application Service
Vendor
CVE Published:
7 March 2019

What is CVE-2019-3777?

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

Affected Version(s)

Apps Manager 666 < 666.0.19

Apps Manager 665 < 665.0.26

Apps Manager 667 < 667.0.5

References

http://www.securityfocus.com/bid/107214
vdb-entryx_refsource_BID
https://pivotal.io/security/cve-2019-3777
x_refsource_CONFIRM

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

CVSS V3.0

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.