CVE-2019-3784: Cloud Foundry Stratos contains a Session Collision Vulnerability
Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3784?
CVE-2019-3784 is a vulnerability in Cloud Foundry Stratos versions prior to 2.3.0 that allows for session spoofing.
How does CVE-2019-3784 affect Cloud Foundry Stratos?
CVE-2019-3784 affects Cloud Foundry Stratos versions prior to 2.3.0.
What is the severity of CVE-2019-3784?
The severity of CVE-2019-3784 is high with a CVSS score of 6.5.
How can a malicious user exploit CVE-2019-3784?
A remote authenticated malicious user can switch sessions to another user with the same session ID in Cloud Foundry Stratos versions prior to 2.3.0.
Is there a fix for CVE-2019-3784?
Yes, the fix for CVE-2019-3784 is to update Cloud Foundry Stratos to version 2.3.0 or later.