PT-2019-16713 · Cloud Foundry · Cloud Foundry Stratos

Publicado 2019-03-07 · Atualizado 2020-10-19 · CVE-2019-3783

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Stratos versions prior to 2.3.0

Description The issue allows a malicious user with knowledge of the default session store secret to brute force another user's current session and act on their behalf.

Recommendations For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, consider changing the default session store secret to a unique and secure value until a patch is applied. Restrict access to sensitive operations to minimize the risk of exploitation.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-1188

CWE-384

Identificadores relacionados

CVE-2019-3783

Produtos afetados

Cloud Foundry Stratos

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-3783 · Aviso do Fabricante
• https://cloudfoundry.org/blog/cve-2019-3783 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3783 · Nota de Segurança