CVE-2019-3784

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.

Score

CVSS 3.0 8.2 High

Status

Modified - security_alert@emc.com

Published

2019-03-07

Last modified

2024-09-16

Weaknesses

CWE-384

Affected products

• Stratos (Cloud Foundry)
• Stratos (Cloudfoundry)

References

• https://www.cloudfoundry.org/blog/cve-2019-3784