PT-2018-13186 · Pivotal · Pivotal Cloud Foundry On Demand Services Sdk

Published 2018-11-19 · Updated 2019-10-09 · CVE-2018-15759

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry On Demand Services SDK versions prior to 0.24

Description The issue concerns an insecure method of verifying credentials, allowing a remote unauthenticated malicious user to make multiple requests to the service broker with different credentials. This enables them to infer valid credentials and gain access to perform broker operations.

Recommendations For versions prior to 0.24, update to version 0.24 or later to resolve the issue.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2018-15759

Affected Products

Pivotal Cloud Foundry On Demand Services Sdk

References · 5

• https://osv.dev/vulnerability/CVE-2018-15759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15759 · Security Note
• https://pivotal.io/security/cve-2018-15759 · Vendor Advisory
• http://securityfocus.com/bid/106019 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15759 · Note