Improper access control

2018-09-1716:29:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

JSON

Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.

CPENameOperatorVersion
pivotal_application_servicege2.2.0
pivotal_application_servicelt2.2.5
pivotal_application_servicege2.1.0
pivotal_application_servicelt2.1.13
pivotal_application_servicege2.0.0
pivotal_application_servicelt2.0.21

Name	Operator	Version
pivotal_application_service	ge	2.2.0
pivotal_application_service	lt	2.2.5
pivotal_application_service	ge	2.1.0
pivotal_application_service	lt	2.1.13
pivotal_application_service	ge	2.0.0
pivotal_application_service	lt	2.0.21

References

pivotal.io/security/cve-2018-11086