Pivotal Operations Manager gives all users heightened privileges
CVE-2018-15762

9CRITICAL

Key Information:

Vendor

Pivotal Cloud Foundry

Status
Pivotal Operations Manager
Vendor
CVE Published:
2 November 2018

What is CVE-2018-15762?

Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.

Affected Version(s)

Pivotal Operations Manager 2.0.x < 2.0.24

Pivotal Operations Manager 2.1.x < 2.1.15

Pivotal Operations Manager 2.2.x < 2.2.7

References

https://pivotal.io/security/cve-2018-15762
x_refsource_CONFIRM

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

CVSS V3.0

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.