CVE-2018-11086

EUVD-2018-3130
Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
pivotal_softwarepivotal_application_service
2.0.0 ≤
𝑥
< 2.0.21
pivotal_softwarepivotal_application_service
2.1.0 ≤
𝑥
< 2.1.13
pivotal_softwarepivotal_application_service
2.2.0 ≤
𝑥
< 2.2.5
𝑥
= Vulnerable software versions
References
https://pivotal.io/security/cve-2018-11086
https://pivotal.io/security/cve-2018-11086