cloudfoundry stratos vulnerabilities

Latest cloudfoundry stratos CVEs

Newest publication first

1. CVE-2019-3784 Cloud Foundry Stratos contains a Session Collision Vulnerability

   Published 2019-03-07

   Medium·CVSS 6.5 EPSS 1.1%

   Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the...

2. CVE-2019-3783 Cloud Foundry Stratos Deploys With Public Default Session Store Secret

   Published 2019-03-07

   High·CVSS 8.8 EPSS 0.90%

   Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.