CVE-2019-3783CWE-384

Cloud Foundry Stratos Deploys With Public Default Session Store Secret

High · published March 7, 2019

CVSS v3.0
8.7
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.

The record
Technical detail
CVSS v3.0
8.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00899 · 59.2th percentile
Weakness
CWE-384 · Session Fixation
Published
2019-03-07T19:00Z
EPSS history
Timeline
  • 07 MAR 19:00Z
    Cloud Foundry Stratos Deploys With Public Default Session Store Secret
    cvelistv5