CVE-2019-3801: cloud foundry cf-deployment Download of Code Without Integrity Check
CVSS: 9.8v3.1CriticalModified
Published 25-04-2019Last modified 17-09-2024
Vulnerability summary
CVE-2019-3801 is a critical (CVSS 9.8) Download of Code Without Integrity Check vulnerability in cloud foundry cf-deployment. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.59%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 25-04-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.
CVSS metrics
4 scores · 2 sources · 3 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
High 8.7Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NSourcesAll 2 agree
- NVDNIST8.7HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.59% on 19-09-2026
19-09-202619-10-2026
EPSS score0.59%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected systems
Cloud foundry3 products
- cf-deployment≥ All, < v7.9.0
- credhub≥ 2.1, < 2.1.3 | ≥ 1.9, < 1.9.10
- uaa release (oss)≥ All, < v64.0
Cloudfoundry3 products
- cf-deployment< 7.9.0
- credhub≥ 1.9, < 1.9.10 | ≥ 2.1, < 2.1.3
- uaa_release< 64.0
Pivotal1 product
- uaa release (lts)≥ v60, < v60.2 | ≥ v64, < v64.1
3 vendors · 7 products