CVE-2019-3777 json
Apps Manager unverified SSL certs in Cloud Controller proxy
published 2019-03-07 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13409
- cvss
- 8.0
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller
Patch / fix
- Pivotal Apps Manager 665.0.26, 666.0.19, 667.0.5
- Pivotal Pivotal Application Service 2.2.12, 2.3.7, 2.4.3
Exploit prediction
1.91% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.0 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Pivotal Apps Manager
- Pivotal Pivotal Application Service
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
pivotal.io
/security/cve-2019-3777
vendor-advisory
-
securityfocus.com
/bid/107214
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2019-3777
- NVD CVE-2019-3777
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.