« Volver al listado

CVE-2018-11086

Estado: ModificadaAlta (8.8)—

Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pivotal Software — Pivotal Application Service

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-11086",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Pivotal",
          "product": "Application Service",
          "versions": [
            {
              "status": "affected",
              "version": "2.0",
              "lessThan": "2.0.21",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.1",
              "lessThan": "2.1.13",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.2",
              "lessThan": "2.2.5",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-09-17T16:29:00.300",
  "references": [
    {
      "url": "https://pivotal.io/security/cve-2018-11086",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://pivotal.io/security/cve-2018-11086",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role."
    },
    {
      "lang": "es",
      "value": "Pivotal Usage Service en Pivotal Application Service, en versiones 2.0 anteriores a la 2.0.21 y versiones 2.1 anteriores a la 2.1.13 y versiones 2.2 anteriores a la 2.2.5, contiene un error que podría permitir el escalado de privilegios. Un desarrollador de espacio con acceso al org del sistema podría ser capaz de acceder a un artefacto que contiene las credenciales de administrador CF, lo que les permite escalar a un rol admin."
    }
  ],
  "lastModified": "2026-06-17T01:35:14.607",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FC5044B-CB33-4E88-B683-AD6D7E3D49A7",
              "versionEndExcluding": "2.0.21",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "200BBCCE-4699-4378-BE71-82327292279F",
              "versionEndExcluding": "2.1.13",
              "versionStartIncluding": "2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52ADEA63-2E24-46F9-BE9E-FEBB96F5D57C",
              "versionEndExcluding": "2.2.5",
              "versionStartIncluding": "2.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}