PT-2018-13188 · Pivotal · Pivotal Operations Manager

Published 2018-11-02 · Updated 2019-10-09 · CVE-2018-15762

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Operations Manager versions 2.0.x through 2.0.23 Pivotal Operations Manager versions 2.1.x through 2.1.14 Pivotal Operations Manager versions 2.2.x through 2.2.6 Pivotal Operations Manager versions 2.3.x through 2.3.0

Description The issue allows all users to be granted a scope that enables privilege escalation. A remote malicious user who has been authenticated can create a new client with administrator privileges for Opsman.

Recommendations For versions 2.0.x through 2.0.23, update to version 2.0.24 or later. For versions 2.1.x through 2.1.14, update to version 2.1.15 or later. For versions 2.2.x through 2.2.6, update to version 2.2.7 or later. For versions 2.3.x through 2.3.0, update to version 2.3.1 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-15762

Affected Products

Pivotal Operations Manager

References · 3

• https://pivotal.io/security/cve-2018-15762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15762 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15762 · Vendor Advisory