CVE-2019-3777

9.8 criticalEPSS 1.9%

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2019-03-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:application_service

References

http://www.securityfocus.com/bid/107214
https://pivotal.io/security/cve-2019-3777
http://www.securityfocus.com/bid/107214
https://pivotal.io/security/cve-2019-3777

Check your stack JSON