CVE-2019-3783

2019-03-0718:29:00

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

42.8%

JSON

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user’s current Stratos session, and act on behalf of that user.

CPENameOperatorVersion
stratoseq0.9.7
stratoseq2.0.0-cap-test
stratoseq2.2.0-4
stratoseq2.0.0-rc1
stratoseq2.1.2
stratoseq0.9.2
stratoseq2.1.1-3
stratoseqdepcache
stratoseq2.1.1-1
stratoseq2.0.1

Name	Operator	Version
stratos	eq	0.9.7
stratos	eq	2.0.0-cap-test
stratos	eq	2.2.0-4
stratos	eq	2.0.0-rc1
stratos	eq	2.1.2
stratos	eq	0.9.2
stratos	eq	2.1.1-3
stratos	eq	depcache
stratos	eq	2.1.1-1
stratos	eq	2.0.1