PT-2018-11374 · Pivotal · Pivotal Application Service

Publicado 2018-05-11 · Atualizado 2019-10-03 · CVE-2018-1278

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Application Service versions 1.12.x prior to 1.12.22 Pivotal Application Service versions 2.0.x prior to 2.0.13 Pivotal Application Service versions 2.1.x prior to 2.1.4

Description The issue allows a member of any organization to create invitations to any other organization for which the organization GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas, and other information about the organization.

Recommendations For versions 1.12.x prior to 1.12.22, update to version 1.12.22 or later. For versions 2.0.x prior to 2.0.13, update to version 2.0.13 or later. For versions 2.1.x prior to 2.1.4, update to version 2.1.4 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-1278

Produtos afetados

Pivotal Application Service

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-1278 · Aviso do Fabricante
• http://securityfocus.com/bid/104227 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1278 · Nota de Segurança
• https://pivotal.io/security/cve-2018-1278 · Aviso do Fabricante