CVE-2019-3793: Invitations Service supports HTTP connections
Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3793?
The severity of CVE-2019-3793 is critical with a CVSS score of 9.8.
Which versions of Pivotal Apps Manager Release are affected by CVE-2019-3793?
Pivotal Apps Manager Release versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, and versions 667.0.x prior to 667.0.7 are affected by CVE-2019-3793.
What is the vulnerability in CVE-2019-3793?
CVE-2019-3793 is a vulnerability in Pivotal Apps Manager Release that allows remote unauthenticated users to gain access to authorization credentials.
How can a remote unauthenticated user exploit CVE-2019-3793?
A remote unauthenticated user can exploit CVE-2019-3793 by listening to network traffic.
Is there a fix available for CVE-2019-3793?
Yes, a fix is available for CVE-2019-3793. Users should update to Pivotal Apps Manager Release versions 665.0.28, 666.0.21, or 667.0.7 or later.