CVE-2019-3777

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.91%

Published

Mar 7, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

Weaknesses (CWE)

CWE-295CWE-295

Affected Products (3)

pivotal_software · application_service (up to 2.2.12)vulnerable

pivotal_software · application_service (up to 2.3.7)vulnerable

pivotal_software · application_service (up to 2.4.3)vulnerable

References (4)

http://www.securityfocus.com/bid/107214

Third Party AdvisoryVDB Entry

https://pivotal.io/security/cve-2019-3777

Vendor Advisory

http://www.securityfocus.com/bid/107214

Third Party AdvisoryVDB Entry

https://pivotal.io/security/cve-2019-3777

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs