Intel

CVE-2019-3784

stratos: Session Fixation (CVE-2019-3784)

highEPSS 1.1%

Description

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.

Source: CVELISTV5NVD

Metrics

Severity
high
Priority score
78.48
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
8.2
Source: cna-v3
CVSS v3
8.2
CVSS v4
—
EPSS percentile
62.5 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
1.1 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2019-03-07 19:00 UTC
CWE
CWE-384

Weakness classes (CWE)

  • CWE-384Compound

    Session Fixation

    Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cloudfoundry

    stratos2.3.0

References & sources

IDCVE-2019-3784