Vulnerability Description
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attacker to read the type of access a user has over an app. They may also modify the logging level, potentially leading to lost information that would otherwise have been logged.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Application Service | >= 2.3.0, < 2.3.16 |
Related Weaknesses (CWE)
References
- https://pivotal.io/security/cve-2019-11276Vendor Advisory
- https://pivotal.io/security/cve-2019-11276Vendor Advisory
FAQ
What is CVE-2019-11276?
CVE-2019-11276 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplic...
How severe is CVE-2019-11276?
CVE-2019-11276 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11276?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Application Service.