CVE-2019-3777

Apps Manager unverified SSL certs in Cloud Controller proxy

State: Published
Severity: 8.0 High
Published: Mar 7, 2019
Updated: Sep 16, 2024
Reserved: Jan 3, 2019

Description

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

Scores

CVSS	Score	Vector	Source
3.0	8.0 High	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N	dell

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
Apps ManagerPivotal	666 to before 666.0.19Affected 665 to before 665.0.26Affected 667 to before 667.0.5Affected
Pivotal Application ServicePivotal	2.4 to before 2.4.3Affected 2.3 to before 2.3.7Affected 2.2 to before 2.2.12Affected

References

107214vdb-entry
https://pivotal.io/security/cve-2019-3777

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.