Vulnerability Details : CVE-2019-11276
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attacker to read the type of access a user has over an app. They may also modify the logging level, potentially leading to lost information that would otherwise have been logged.
Products affected by CVE-2019-11276
- cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-11276
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-11276
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.8
|
MEDIUM | AV:A/AC:L/Au:N/C:P/I:P/A:N |
6.5
|
4.9
|
NIST | |
5.4
|
MEDIUM | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
2.8
|
2.5
|
Pivotal Software, Inc. | |
5.4
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
2.8
|
2.5
|
NIST |
CWE ids for CVE-2019-11276
-
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.Assigned by:
- nvd@nist.gov (Primary)
- security@pivotal.io (Secondary)
References for CVE-2019-11276
-
https://pivotal.io/security/cve-2019-11276
File Not Found | PivotalVendor Advisory
Jump to