CVE-2018-1278

CVE-2018-1278: vulnerability in Pivotal Application Service

Published · Updated

Follow this CVE+ Monitor Pivotal Application Service

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.2%
Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas and other information about the org.
Affected products
Pivotal · Pivotal Application Service
Related CVEs — Pivotal Application Service

In the same product, most dangerous first.

CVE-2019-3777HIGHApps Manager unverified SSL certs in Cloud Controller proxyEPSS 1.9%CVE-2019-3788HIGHUAA redirect-uri allows wildcard in the subdomainEPSS 0.8%CVE-2018-11044—CVE-2018-11044EPSS 0.7%