CVEvulnerability

CVE-2019-11280

8.8 HIGH Published 2019-09-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-269

Description

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.

Affected configurations

• pivotal software pivotal application service (>= 2.3.0 < 2.3.18) • pivotal software pivotal application service (>= 2.4.0 < 2.4.14) • pivotal software pivotal application service (>= 2.5.0 < 2.5.10) • pivotal software pivotal application service (>= 2.6.0 < 2.6.5)

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References