Vulnerability in Pivotal Apps Manager
CVE-2019-3777
Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller
Vulnerability class: Improper Certificate Validation
EPSS: 0.019 (78.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Pivotal Apps Manager — versions 666, 665, 667
- Pivotal Application Service — versions 2.4, 2.3, 2.2
- Pivotal_software Application_service
Weakness classification (CWE)
References
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security_alert@emc.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-3777?
- CVE-2019-3777 is a high-severity vulnerability in Pivotal Apps Manager, classified under Improper Certificate Validation. CVSS score: 8.0/10. Published 2019-03-07.
- How severe is CVE-2019-3777?
- High severity. CVSS v3 base score is 8.0 out of 10.