Read the docs
TI-2019-02806 Aliases CVE-2019-3793GHSA-67rq-xjmx-ww89

Invitations Service supports HTTP connections

Priority MEDIUM 44CWE-300Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.

Why it matters now

EPSS 0.01053 64th percentileScored 2026-11-07
Fix Fixed Apps Manager (Pivotal): 666.0.21, 667.0.7, 665.0.28

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PivotalApps Manager666 to before 666.0.21; 667 to before 667.0.7; 665 to before 665.0.28666.0.21, 667.0.7, 665.0.28Patch availableCNA
  • Apps Manager VendorPivotal Affected 666 to before 666.0.21; 667 to before 667.0.7; 665 to before 665.0.28 Fixed in 666.0.21, 667.0.7, 665.0.28 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:*665.0.0 to before 665.0.28; 666.0.0 to before 666.0.21; 667.0.0 to before 667.0.7VulnerableSpring by Pivotal
  • cpe:2.3:a:pivotal_software:application_service:*:*:*:*:*:*:*:* Versions 665.0.0 to before 665.0.28; 666.0.0 to before 666.0.21; 667.0.0 to before 667.0.7 Vulnerable ·Spring by Pivotal

Remediation

  • Fix · CNA Apps Manager (Pivotal) Fixed in 666.0.21, 667.0.7, 665.0.28

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3793
  2. 2026-10-03 Alias added: GHSA-67rq-xjmx-ww89

References

Advisory 1

  • TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
  • TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
  • TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
  • TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
  • TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
  • TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences