CVE-2019-3793: pivotal_software application_service Channel Accessible by Non-Endpoint
Vulnerability summary
CVE-2019-3793 is a critical (CVSS 9.8) Channel Accessible by Non-Endpoint vulnerability in pivotal_software application_service. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.7% of scored vulnerabilities.
Timeline
- 24-04-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST8.1HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.05% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected systems
Pivotal1 product
- apps_manager≥ 666, < 666.0.21 | ≥ 667, < 667.0.7 | ≥ 665, < 665.0.28
Pivotal_software1 product
- application_service≥ 665.0.0, < 665.0.28 | ≥ 666.0.0, < 666.0.21 | ≥ 667.0.0, < 667.0.7
2 vendors · 2 products