PT-2019-16708 · Pivotal · Pivotal Application Service

Published 2019-03-07 · Updated 2019-10-09 · CVE-2019-3777

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Application Service (PAS) versions 2.2.x through 2.2.11 Pivotal Application Service (PAS) versions 2.3.x through 2.3.6 Pivotal Application Service (PAS) versions 2.4.x through 2.4.2

Description The issue concerns a failure to verify SSL certificates by the cloud controller proxy in the apps manager. This could allow a remote unauthenticated attacker, who has hijacked the Cloud Controller's DNS record, to intercept access tokens sent to the Cloud Controller. As a result, the attacker could gain access to the user's resources in the Cloud Controller.

Recommendations For Pivotal Application Service (PAS) versions 2.2.x through 2.2.11, update to version 2.2.12 or later. For Pivotal Application Service (PAS) versions 2.3.x through 2.3.6, update to version 2.3.7 or later. For Pivotal Application Service (PAS) versions 2.4.x through 2.4.2, update to version 2.4.3 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-3777

Affected Products

Pivotal Application Service

References · 4

• https://pivotal.io/security/cve-2019-3777 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3777 · Security Note
• http://securityfocus.com/bid/107214 · Note