CVE-2018-15759
Last modified
CVE-2018-15759 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.. EPSS estimates a 1.75% chance of exploitation in the next 30 days.
Description
Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Broker Api | < 3.0.2 |
| Pivotal Software | On Demand Services Sdk | < 0.24.0 |
References
- https://www.securityfocus.com/bid/106019Third Party Advisory, VDB Entry
- https://pivotal.io/security/cve-2018-15759Vendor Advisory
- https://www.securityfocus.com/bid/106019Third Party Advisory, VDB Entry
- https://pivotal.io/security/cve-2018-15759Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-15759?
How severe is CVE-2018-15759?
How do I fix CVE-2018-15759?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-15753An issue was discovered in the MensaMax (aka com.breustedt.m…
- CVE-2018-15754Cloud Foundry UAA, versions 60 prior to 66.0, contain an aut…4.2
- CVE-2018-15755Cloud Foundry CF Networking Release, versions 2.11.0 prior t…6.6
- CVE-2018-15756Spring Framework, version 5.1, versions 5.0.x prior to 5.0.1…7.5
- CVE-2018-15757Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15758Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 …9.6
- CVE-2018-15760Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15761Cloud Foundry UAA release, versions prior to v64.0, and UAA,…9.9
- CVE-2018-15762Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, …9
- CVE-2018-15763Pivotal Container Service, versions prior to 1.2.0, contains…9
- CVE-2018-15764Dell EMC ESRS Policy Manager versions 6.8 and prior contain …9.8
- CVE-2018-15765Dell EMC Secure Remote Services, versions prior to 3.32.00.0…3.4
Are you affected by CVE-2018-15759?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST