CVE-2018-11044
Last modified
CVE-2018-11044 is a vulnerability of currently unknown severity. Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Pivotal Application Service | >= 1.12.0, < 1.12.26 |
| Pivotal Software | Pivotal Application Service | >= 2.0.0, < 2.0.17 |
| Pivotal Software | Pivotal Application Service | >= 2.1.0, < 2.1.8 |
| Pivotal Software | Pivotal Application Service | >= 2.2.0, < 2.2.1 |
References
- https://pivotal.io/security/cve-2018-11044Mitigation, Vendor Advisory
- https://pivotal.io/security/cve-2018-11044Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-11044?
How severe is CVE-2018-11044?
How do I fix CVE-2018-11044?
Are you affected by CVE-2018-11044?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST