CVE-2019-11275
Last modified
CVE-2019-11275 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.. EPSS estimates a 1.07% chance of exploitation in the next 30 days.
Description
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pivotal | Apps Manager | >= 666.0.0, < 666.0.36 |
| Pivotal | Apps Manager | >= 667.0.0, < 667.0.22 |
| Pivotal | Apps Manager | >= 668.0.0, < 668.0.21 |
| Pivotal | Apps Manager | >= 669.0.0, < 669.0.13 |
| Pivotal | Apps Manager | >= 670.0.0, < 670.0.7 |
| Pivotal Software | Pivotal Application Service | >= 2.3.0, <= 2.3.18 |
| Pivotal Software | Pivotal Application Service | >= 2.4.0, <= 2.4.14 |
| Pivotal Software | Pivotal Application Service | >= 2.5.0, <= 2.5.1 |
| Pivotal Software | Pivotal Application Service | >= 2.6.0, <= 2.6.5 |
References
- https://pivotal.io/security/cve-2019-11275Vendor Advisory
- https://pivotal.io/security/cve-2019-11275Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11275?
How severe is CVE-2019-11275?
How do I fix CVE-2019-11275?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1127A remote code execution vulnerability exists in the way that…
- CVE-2019-11270Cloud Foundry UAA versions prior to v73.4.0 contain a vulner…7.5
- CVE-2019-11271Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain…7.8
- CVE-2019-11272Spring Security, versions 4.2.x up to 4.2.12, and older unsu…7.3
- CVE-2019-11273Pivotal Container Services (PKS) versions 1.3.x prior to 1.3…4.3
- CVE-2019-11274Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable t…6.1
- CVE-2019-11276Pivotal Apps Manager, included in Pivotal Application Servic…5.4
- CVE-2019-11277Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.…8.1
- CVE-2019-11278CF UAA versions prior to 74.1.0, allow external input to be …8.8
- CVE-2019-11279CF UAA versions prior to 74.1.0 can request scopes for a cli…8.8
- CVE-2019-1128A remote code execution vulnerability exists in the way that…
- CVE-2019-11280Pivotal Apps Manager, included in Pivotal Application Servic…8.8
Are you affected by CVE-2019-11275?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST