Pivotal Software Application Service vulnerabilities

4 CVEs affecting Pivotal Software Application Service, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11276, published 2019-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3777, published 2019-03-07. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL…
CVE-2019-11270, published 2019-08-05. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created…
CVE-2019-3793, published 2019-04-24. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote…
CVE-2019-11276, published 2019-08-19. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the…