Intel

CVE-2019-3801

cf-deployment: Download of Code Without Integrity Check (CVE-2019-3801)

criticalEPSS 0.6%

Description

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

Source: CVELISTV5NVD

Metrics

Severity
critical
Priority score
71.12
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
8.7
CVSS v4
—
EPSS percentile
46.2 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2019-04-25 20:17 UTC
CWE
CWE-494

Weakness classes (CWE)

  • CWE-494Base

    Download of Code Without Integrity Check

    The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cloudfoundry

    cf-deployment7.9.0

  • cloudfoundry

    credhub1.9 – 1.9.10

  • cloudfoundry

    credhub2.1 – 2.1.3

  • cloudfoundry

    uaa_release64.0

References & sources

IDCVE-2019-3801