CVE-2019-3801

Java Projects using HTTP to fetch dependencies

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Cf-deployment Credhub Uaa Release

CVE-2019-3800

CF CLI writes the client id and secret to config file

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

CVSS 3.0 · 6.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Anynines Apigee Appdynamics and 24 more

Products

Elasticsearch Logme Mongodb and 52 more

CVE-2019-3799

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

CVSS 3.1 · 6.5 Medium EPSS 85.3% KEV · Not listed

Vendors

Oracle Vmware

Products

Communications Cloud Native Core Policy Spring Cloud Config

CVE-2019-3798

Escalation of Privileges in Cloud Controller

Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.

CVSS 3.0 · 6 Medium EPSS 1.3% KEV · Not listed

Vendors

Cloudfoundry

Products

Capi-release

CVE-2019-3797

Additional information exposure with Spring Data JPA derived queries

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

CVSS 3.0 · 3.5 Low EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software Redhat

Products

Spring Data Java Persistence Api Jboss Fuse

CVE-2019-3795

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Vmware

Products

Debian Linux Spring Security

CVE-2019-3794

UAA - Login app subject to clickjacking attack

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Cloud Foundry Uaa

CVE-2019-3793

Invitations Service supports HTTP connections

Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Application Service

CVE-2019-3792

Concourse 5.0.0 SQL Injection vulnerability

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

CVSS 3.0 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Concourse

CVE-2019-3790

Ops Manager uaa client issues tokens after refresh token expiration

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Pivotal Software

Products

Operations Manager

CVE-2019-3789

Gorouter allows space developer to hijack route services hosted outside the platform

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Routing Release

CVE-2019-3788

UAA redirect-uri allows wildcard in the subdomain

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.

CVSS 3.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Uaa Release

CVE-2019-3787

UAA defaults email address to an insecure domain

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.

CVSS 3.0 · 8.3 High EPSS 1.1% KEV · Not listed

Vendors

Pivotal Software

Products

Cloud Foundry Uaa-release

CVE-2019-3786

BBR could run arbitrary scripts on deployment VMs

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Bosh Backup And Restore

CVE-2019-3785

Cloud Controller provides signed URL with write authorization to read only user

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed

Vendors

Cloudfoundry

Products

Capi-release

CVE-2019-3784

Cloud Foundry Stratos contains a Session Collision Vulnerability

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.

CVSS 3.0 · 8.2 High EPSS 1.1% KEV · Not listed

Vendors

Cloudfoundry

Products

Stratos

CVE-2019-3783

Cloud Foundry Stratos Deploys With Public Default Session Store Secret

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Stratos

CVE-2019-3782

CredHub CLI writes environment variable credentials to disk

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Credhub Cli

CVE-2019-3781

CF CLI does not sanitize user's password in verbose/trace/debug

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Cloudfoundry

Products

Command Line Interface

CVE-2019-3780

Cloud Foundry Container Runtime Leaks IAAS Credentials

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Cloudfoundry

Products

Container Runtime