CVE-2019-3793 - CVE House
Back to Database
Status published High CVE-2019-3793

Invitations Service supports HTTP connections

Vulnerability Description

Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-3793

Credits & Attribution

No credits recorded in the NVD database.

References

More from Pivotal

View All →
CVE-2020-5409
Concourse Open Redirect in the /sky/login endpoint
High 7.6
CVE-2020-5406
PCF Autoscaling logs its database credentials
Medium 6.5
CVE-2020-5404
Authentication Leak On Redirect With Reactor Netty HttpClient
Medium 6.5
CVE-2020-5403
DoS Via Malformed URL with Reactor Netty HTTP Server
Medium 6.5
CVE-2019-3803
Concourse includes token in CLI authentication callback
Medium 4.5

Affected Vendor

Affected Software

Apps Manager
Vulnerable Versions:
666, 667, 665

Timeline

Official Publish: April 24th, 2019
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-300

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.