« Volver al listado

CVE-2019-11275

Estado: ModificadaMedia (4.3)—

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Pivotal — Apps ManagerPivotal Software — Pivotal Application Service

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11275",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@pivotal.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@pivotal.io",
      "affectedData": [
        {
          "vendor": "Pivotal",
          "product": "Apps Manager",
          "versions": [
            {
              "status": "affected",
              "version": "670",
              "lessThan": "670.0.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "669",
              "lessThan": "669.0.13",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "668",
              "lessThan": "668.0.21",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "667",
              "lessThan": "667.0.22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "666",
              "lessThan": "666.0.36",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-01T15:15:11.650",
  "references": [
    {
      "url": "https://pivotal.io/security/cve-2019-11275",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@pivotal.io"
    },
    {
      "url": "https://pivotal.io/security/cve-2019-11275",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@pivotal.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege."
    },
    {
      "lang": "es",
      "value": "Pivotal Application Manager, versiones 666.0.x anteriores a 666.0.36, versiones 667.0.x anteriores a 667.0.22, versiones 668.0.x anteriores a 668.0.21, versiones 669.0.x anteriores a 669.0.13 y versiones 670.0.x anteriores a 670.0.7, contienen una vulnerabilidad donde un usuario autenticado remoto puede crear una aplicación con un nombre tal que un programa csv pueda interpretar en una fórmula y ser ejecutado. El usuario malicioso puede conseguir acceso a un reporte de uso que requiere un mayor privilegio."
    }
  ],
  "lastModified": "2026-06-17T02:12:39.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D44F12A8-BB85-4F47-9422-0C5070B1554B",
              "versionEndExcluding": "666.0.36",
              "versionStartIncluding": "666.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "279FE72A-4CD1-436D-A069-FAB0A70166DA",
              "versionEndExcluding": "667.0.22",
              "versionStartIncluding": "667.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFC5E0B9-2897-432B-9972-7C66372E7998",
              "versionEndExcluding": "668.0.21",
              "versionStartIncluding": "668.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFBF0CCE-5C54-4DBA-A784-054ED1FEE142",
              "versionEndExcluding": "669.0.13",
              "versionStartIncluding": "669.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D0D669E-2444-43F3-B3FA-1BEB3AF063D1",
              "versionEndExcluding": "670.0.7",
              "versionStartIncluding": "670.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B355FF03-4AEE-46CF-A357-60E28D6BE1C9",
              "versionEndIncluding": "2.3.18",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "799BBFDE-7A92-4976-B823-F06D37D27312",
              "versionEndIncluding": "2.4.14",
              "versionStartIncluding": "2.4.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8198778A-7E47-4927-83FB-3C52F8C8EC8F",
              "versionEndIncluding": "2.5.1",
              "versionStartIncluding": "2.5.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "828C8237-0F42-46F0-BC25-C232016A8B93",
              "versionEndIncluding": "2.6.5",
              "versionStartIncluding": "2.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@pivotal.io"
}