CVE-2019-3795

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Vmware

Products

Debian Linux Spring Security

CVE-2019-3794

UAA - Login app subject to clickjacking attack

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Cloud Foundry Uaa

CVE-2019-3793

Invitations Service supports HTTP connections

Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Application Service

CVE-2019-3792

Concourse 5.0.0 SQL Injection vulnerability

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

CVSS 3.0 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Concourse

CVE-2019-3790

Ops Manager uaa client issues tokens after refresh token expiration

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Pivotal Software

Products

Operations Manager

CVE-2019-3789

Gorouter allows space developer to hijack route services hosted outside the platform

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Routing Release

CVE-2019-3788

UAA redirect-uri allows wildcard in the subdomain

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.

CVSS 3.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Uaa Release

CVE-2019-3787

UAA defaults email address to an insecure domain

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.

CVSS 3.0 · 8.3 High EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Cloud Foundry Uaa-release

CVE-2019-3786

BBR could run arbitrary scripts on deployment VMs

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Bosh Backup And Restore

CVE-2019-3785

Cloud Controller provides signed URL with write authorization to read only user

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed

Vendors

Cloudfoundry

Products

Capi-release

CVE-2019-3784

Cloud Foundry Stratos contains a Session Collision Vulnerability

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.

CVSS 3.0 · 8.2 High EPSS 1.1% KEV · Not listed

Vendors

Cloudfoundry

Products

Stratos

CVE-2019-3783

Cloud Foundry Stratos Deploys With Public Default Session Store Secret

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Stratos

CVE-2019-3782

CredHub CLI writes environment variable credentials to disk

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Credhub Cli

CVE-2019-3781

CF CLI does not sanitize user's password in verbose/trace/debug

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Cloudfoundry

Products

Command Line Interface

CVE-2019-3780

Cloud Foundry Container Runtime Leaks IAAS Credentials

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Cloudfoundry

Products

Container Runtime

CVE-2019-3779

Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD

Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the Kubernetes CSR capability to obtain a credential that could escalate privilege access to ETCD.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Container Runtime

CVE-2019-3778

Open Redirect in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

CVSS 3.1 · 6.5 Medium EPSS 16.6% KEV · Not listed

Vendors

Oracle Pivotal Software

Products

Banking Corporate Lending Spring Security Oauth

CVE-2019-3777

Apps Manager unverified SSL certs in Cloud Controller proxy

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

CVSS 3.0 · 8 High EPSS 1.9% KEV · Not listed

Vendors

Pivotal Software

Products

Application Service

CVE-2019-3776

Reflected XSS in Pivotal Operations Manager

Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.

CVSS 3.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Pivotal Software

Products

Operations Manager

CVE-2019-3775

UAA allows users to modify their own email address

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Uaa Release