Vulnerability in Pivotal Apps Manager
CVE-2019-3777
Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.019 (79.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 79.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.019 · newest: 0.019 · change: 0.000
Affected products
- Pivotal Apps Manager — versions 666, 665, 667
- Pivotal Application Service — versions 2.4, 2.3, 2.2
- Pivotal Software Application Service
Weakness classification (CWE)
References
- www.securityfocus.com/bid/107214 (VDB Entry, Third Party Advisory, vdb-entry)
- pivotal.io/security/cve-2019-3777 (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-3777?
- CVE-2019-3777 is a high-severity vulnerability in Pivotal Apps Manager, classified under Improper Certificate Validation. CVSS score: 8.0/10. Published 2019-03-07.
- How severe is CVE-2019-3777?
- High severity. CVSS v3 base score is 8.0 out of 10.