title: Invitations Service supports HTTP connections
description: Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.
problem types: CWE-300: Man-in-the-Middle
affected:
{
product: Apps Manager
vendor: Pivotal
versions:
lessThan: 666.0.21, status: affected, version: 666, versionType: custom
lessThan: 667.0.7, status: affected, version: 667, versionType: custom
lessThan: 665.0.28, status: affected, version: 665, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.0
]