CVE-2019-3777

HIGH

Pivotal Application Service 2.2.0-2.2.11, 2.3.0-2.3.6, 2.4.0-2.4.2 - SSL Certificate Validation Bypass

Title source: llm
STIX 2.1

Description

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/107214
Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2019-3777

Scores

CVSS v3 8.0
EPSS 0.0191
EPSS Percentile 77.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Details

CWE
CWE-295
Status published
Products (1)
pivotal_software/application_service 2.2.0 - 2.2.12
Published Mar 07, 2019
Tracked Since Feb 18, 2026