CVE-2019-3784
Last modified
CVE-2019-3784 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.. EPSS estimates a 1.08% chance of exploitation in the next 30 days.
Description
Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.
Metrics
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cloudfoundry | Stratos | < 2.3.0 |
References
- https://www.cloudfoundry.org/blog/cve-2019-3784Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2019-3784Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-3784?
How severe is CVE-2019-3784?
How do I fix CVE-2019-3784?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-3778Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 …6.5
- CVE-2019-3779Cloud Foundry Container Runtime, versions prior to 0.29.0, d…8.8
- CVE-2019-3780Cloud Foundry Container Runtime, versions prior to 0.28.0, d…8.8
- CVE-2019-3781Cloud Foundry CLI, versions prior to v6.43.0, improperly exp…8.8
- CVE-2019-3782Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvert…7.8
- CVE-2019-3783Cloud Foundry Stratos, versions prior to 2.3.0, deploys with…8.8
- CVE-2019-3785Cloud Foundry Cloud Controller, versions prior to 1.78.0, co…8.1
- CVE-2019-3786Cloud Foundry BOSH Backup and Restore CLI, all versions prio…7.1
- CVE-2019-3787Cloud Foundry UAA, versions prior to 73.0.0, falls back to a…8.3
- CVE-2019-3788Cloud Foundry UAA Release, versions prior to 71.0, allows cl…8.7
- CVE-2019-3789Cloud Foundry Routing Release, all versions prior to 0.188.0…6.5
- CVE-2019-3790The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3…6.1
Are you affected by CVE-2019-3784?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST