CVE-2019-3777 - Apps Manager unverified SSL certs in Cloud Controller proxy

Back Back to CVE browser

CRITICAL

Apps Manager unverified SSL certs in Cloud Controller proxy

Published Mar 7, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.91%

Description

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

Affected products

Vendor Pivotal Product Apps Manager Default
n/a
- Version
  665
  Status
  affected
  Constraints
  <665.0.26
- Version
  666
  Status
  affected
  Constraints
  <666.0.19
- Version
  667
  Status
  affected
  Constraints
  <667.0.5
Vendor Pivotal Product Pivotal Application Service Default
n/a
- Version
  2.2
  Status
  affected
  Constraints
  <2.2.12
- Version
  2.3
  Status
  affected
  Constraints
  <2.3.7
- Version
  2.4
  Status
  affected
  Constraints
  <2.4.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pivotal

Apps Manager

n/a

Version	Status	Constraints
665	affected	<665.0.26
666	affected	<666.0.19
667	affected	<667.0.5

Pivotal

Pivotal Application Service

n/a

Version	Status	Constraints
2.2	affected	<2.2.12
2.3	affected	<2.3.7
2.4	affected	<2.4.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (3)

http://www.securityfocus.com/bid/107214
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13409
Advisory
https://pivotal.io/security/cve-2019-3777
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/107214		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13409		Advisory
https://pivotal.io/security/cve-2019-3777		x_refsource_CONFIRMVendor Advisory