PT-2019-12222 · Pivotal · Pivotal Application Manager

Published 2019-10-01 · Updated 2020-10-16 · CVE-2019-11275

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Application Manager versions 666.0.x prior to 666.0.36 Pivotal Application Manager versions 667.0.x prior to 667.0.22 Pivotal Application Manager versions 668.0.x prior to 668.0.21 Pivotal Application Manager versions 669.0.x prior to 669.0.13 Pivotal Application Manager versions 670.0.x prior to 670.0.7

Description The issue allows a remote authenticated user to create an app with a name that can be interpreted by a csv program as a formula, potentially leading to execution. This could enable the malicious user to access a usage report that requires higher privileges.

Recommendations For versions 666.0.x prior to 666.0.36, update to version 666.0.36 or later. For versions 667.0.x prior to 667.0.22, update to version 667.0.22 or later. For versions 668.0.x prior to 668.0.21, update to version 668.0.21 or later. For versions 669.0.x prior to 669.0.13, update to version 669.0.13 or later. For versions 670.0.x prior to 670.0.7, update to version 670.0.7 or later.

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-1236

Related Identifiers

CVE-2019-11275

Affected Products

Pivotal Application Manager

References · 3

• https://pivotal.io/security/cve-2019-11275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11275 · Security Note