PT-2018-10264 · Pivotal · Pivotal Application Service+1

Published 2018-07-24 · Updated 2018-10-01 · CVE-2018-11044

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Apps Manager included in Pivotal Application Service versions 2.2.x prior to 2.2.1 Pivotal Apps Manager included in Pivotal Application Service versions 2.1.x prior to 2.1.8 Pivotal Apps Manager included in Pivotal Application Service versions 2.0.x prior to 2.0.17 Pivotal Apps Manager included in Pivotal Application Service versions 1.12.x prior to 1.12.26

Description The issue concerns the failure to escape all user-provided content when sending invitation emails. This allows a malicious authenticated user to inject content into an invite to another user, exploiting the trust implied by the source of the email.

Recommendations For versions 2.2.x prior to 2.2.1, update to version 2.2.1 or later. For versions 2.1.x prior to 2.1.8, update to version 2.1.8 or later. For versions 2.0.x prior to 2.0.17, update to version 2.0.17 or later. For versions 1.12.x prior to 1.12.26, update to version 1.12.26 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-11044

Affected Products

Pivotal Application Service

Pivotal Apps Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11044 · Security Note
• https://pivotal.io/security/cve-2018-11044 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11044 · Vendor Advisory