CVE Feed

    Dashboard / CVE / CVE-2019-11280

    CVE-2019-11280

    Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.

    Published:Sep 20, 2019
    Last Modified:Nov 21, 2024
    EPS:Sep 20, 2019
    EPSS Score:0.00587
    CVSS Score:8.8

    Affected Products

    Vendor
    Pivotal Software
    Product
    Pivotal Application Service

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2019-11275 (CVSS 4.3) — Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions …
    CVE-2018-11086 (CVSS 8.8) — Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and…
    CVE-2018-11088 (CVSS 8.8) — Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1…
    CVE-2018-11044 (CVSS 6.5) — Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to…
    CVE-2018-1278 (CVSS 6.5) — Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13,…
    CVE-2018-1200 (CVSS 6.5) — Apps Manager for PCF (Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x befo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High