PT-2019-16708 · Pivotal · Pivotal Application Service

Publicado 2019-03-07 · Atualizado 2019-10-09 · CVE-2019-3777

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Application Service (PAS) versions 2.2.x through 2.2.11 Pivotal Application Service (PAS) versions 2.3.x through 2.3.6 Pivotal Application Service (PAS) versions 2.4.x through 2.4.2

Description The issue concerns a failure to verify SSL certificates by the cloud controller proxy in the apps manager. This could allow a remote unauthenticated attacker, who has hijacked the Cloud Controller's DNS record, to intercept access tokens sent to the Cloud Controller. As a result, the attacker could gain access to the user's resources in the Cloud Controller.

Recommendations For Pivotal Application Service (PAS) versions 2.2.x through 2.2.11, update to version 2.2.12 or later. For Pivotal Application Service (PAS) versions 2.3.x through 2.3.6, update to version 2.3.7 or later. For Pivotal Application Service (PAS) versions 2.4.x through 2.4.2, update to version 2.4.3 or later.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-3777

Produtos afetados

Pivotal Application Service

Referências · 4

• https://pivotal.io/security/cve-2019-3777 · Aviso do Fabricante
• http://securityfocus.com/bid/107214 · Nota
• https://osv.dev/vulnerability/CVE-2019-3777 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3777 · Nota de Segurança