Back
CVE-2019-3777
Apps Manager unverified SSL certs in Cloud Controller proxy
High8.0EPSS 1.9%
- Published
- Updated
- Reserved
- Assigned by
- dell
Description
Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| dellCNA (assigner) | 3.0 | High8.0 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.9% · top 20% of all CVEs (5 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Weakness
Affected products
- affected 666 – < 666.0.19
- affected 665 – < 665.0.26
- affected 667 – < 667.0.5
Pivotal · Pivotal Application Service
- affected 2.4 – < 2.4.3
- affected 2.3 – < 2.3.7
- affected 2.2 – < 2.2.12
References (2)
- 107214 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://pivotal.io/security/cve-2019-3777 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-3777)Record last updated .