9.8
CVE-2019-3777
- EPSS 0.72%
- Veröffentlicht 07.03.2019 18:29:00
- Zuletzt bearbeitet 21.11.2024 04:42:31
- Quelle security_alert@emc.com
- Teams Watchlist Login
- Unerledigt Login
Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pivotal Software ≫ Application Service Version >= 2.2.0 < 2.2.12
Pivotal Software ≫ Application Service Version >= 2.3.0 < 2.3.7
Pivotal Software ≫ Application Service Version >= 2.4.0 < 2.4.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.72% | 0.702 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
| security_alert@emc.com | 8 | 1.6 | 5.8 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
|
CWE-295 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.