PT-2018-11374 · Pivotal · Pivotal Application Service

Published 2018-05-11 · Updated 2019-10-03 · CVE-2018-1278

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Application Service versions 1.12.x prior to 1.12.22 Pivotal Application Service versions 2.0.x prior to 2.0.13 Pivotal Application Service versions 2.1.x prior to 2.1.4

Description The issue allows a member of any organization to create invitations to any other organization for which the organization GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas, and other information about the organization.

Recommendations For versions 1.12.x prior to 1.12.22, update to version 1.12.22 or later. For versions 2.0.x prior to 2.0.13, update to version 2.0.13 or later. For versions 2.1.x prior to 2.1.4, update to version 2.1.4 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-1278

Affected Products

Pivotal Application Service

References · 4

• https://osv.dev/vulnerability/CVE-2018-1278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1278 · Security Note
• https://pivotal.io/security/cve-2018-1278 · Vendor Advisory
• http://securityfocus.com/bid/104227 · Note