CVE-2019-3785: falha de média gravidade em Cloud Foundry CAPI
Cloud Controller provides signed URL with write authorization to read only user
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.3%
Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Cloud Foundry · CAPICVEs relacionadas — Cloud Foundry CAPI
No mesmo produto, das mais perigosas para as menos.
CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2020-5417HIGHCloud Controller may allow developers to claim sensitive routesEPSS 1.0%CVE-2019-11294MEDIUMCAPI leaks service broker URLs and GUIDs to space developersEPSS 0.8%CVE-2020-5400HIGHCloud Controller logs environment variables from app manifestsEPSS 0.8%CVE-2020-5418LOWCloud Controller allows users with no roles to list dropletsEPSS 0.6%