PT-2018-13186 · Pivotal · Pivotal Cloud Foundry On Demand Services Sdk

Publicado 2018-11-19 · Atualizado 2019-10-09 · CVE-2018-15759

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry On Demand Services SDK versions prior to 0.24

Description The issue concerns an insecure method of verifying credentials, allowing a remote unauthenticated malicious user to make multiple requests to the service broker with different credentials. This enables them to infer valid credentials and gain access to perform broker operations.

Recommendations For versions prior to 0.24, update to version 0.24 or later to resolve the issue.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2018-15759

Produtos afetados

Pivotal Cloud Foundry On Demand Services Sdk

Referências · 5

• http://securityfocus.com/bid/106019 · Nota
• https://osv.dev/vulnerability/CVE-2018-15759 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15759 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15759 · Nota
• https://pivotal.io/security/cve-2018-15759 · Aviso do Fabricante