CVE-2018-11044

EUVD-2018-3089
Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
Affected Products (NVD)
VendorProductVersion
pivotal_softwarepivotal_application_service
1.12.0 ≤
𝑥
< 1.12.26
pivotal_softwarepivotal_application_service
2.0.0 ≤
𝑥
< 2.0.17
pivotal_softwarepivotal_application_service
2.1.0 ≤
𝑥
< 2.1.8
pivotal_softwarepivotal_application_service
2.2.0 ≤
𝑥
< 2.2.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://pivotal.io/security/cve-2018-11044
https://pivotal.io/security/cve-2018-11044