« Volver al listado

CVE-2018-11045

Estado: ModificadaMedia (5.9)—

Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Fuente: mapeo oficial MITRE CTID (CVE → ATT&CK).

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementPassword PoliciesMulti-factor AuthenticationAccount Use PoliciesApplication Developer GuidanceActive Directory Configuration

Tecnologías afectadas (1)

Pivotal Software — Operations Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-11045",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Pivotal",
          "product": "Pivotal Operations Manager",
          "versions": [
            {
              "status": "affected",
              "version": "2.1",
              "lessThan": "2.1.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.0",
              "lessThan": "2.0.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.12",
              "lessThan": "1.12.22",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-07-11T20:29:00.273",
  "references": [
    {
      "url": "https://pivotal.io/security/cve-2018-11045",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://pivotal.io/security/cve-2018-11045",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-330"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG."
    },
    {
      "lang": "es",
      "value": "Pivotal Operations Manager, en versiones 2.1 anteriores a la 2.1.6 y 2.0 anteriores a la 2.0.15 y 1.12 anteriores a la 1.12.22, contiene un archivo Linux Random Number Generator (LRNG) seed embebido en la imagen de aplicación. Un atacante con conocimiento de la versión exacta e IaaS de un OpsManager en ejecución podría obtener el contenido del seed correspondiente de la imagen publicada y, por lo tanto, inferir el estado inicial del LRNG."
    }
  ],
  "lastModified": "2026-06-17T01:35:09.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7E62FB5-C8ED-44A9-8942-E1D48CBF197A",
              "versionEndExcluding": "1.12.22",
              "versionStartIncluding": "1.12"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A633603-EE12-454C-93B0-7EEE11DC85F6",
              "versionEndExcluding": "2.0.15",
              "versionStartExcluding": "2.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF23A2AD-27E0-4826-AB85-BFCFD800F9BE",
              "versionEndExcluding": "2.1.6",
              "versionStartIncluding": "2.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}