{"id":"CVE-2019-3783","details":"Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.","modified":"2026-08-27T08:40:50.454181Z","published":"2019-03-07T18:29:00.633Z","references":[{"type":"ADVISORY","url":"https://www.cloudfoundry.org/blog/cve-2019-3783"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/stratos","events":[{"introduced":"0"},{"fixed":"a728011a79e47be7eb017394542b8816efc5a596"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.3.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:cloudfoundry:stratos:*:*:*:*:*:*:*:*"}}],"versions":["2.3.0-rc.2","2.3.0-rc.1","depcache","2.2.0-4","2.2.0","2.2.0-5","2.2.0-3","2.1.1-3","2.1.1-2","2.1.1-1","2.1.1-6","2.1.1","2.1.1-5","2.1.1-4","2.1.0","2.1.0-3","2.0.0","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","2.0.0-RC-1","2.0.0-beta-002","2.0.0-beta-0002","v2.0.0-beta-001","s4x"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3783.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}