CVE-2019-11280 is a vulnerability in Pivotal Software Pivotal Application Service
Published on September 20, 2019
Privilege escalation through the invitations service
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.
Weakness Type
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Products Associated with CVE-2019-11280
Want to know whenever a new CVE is published for Pivotal Software Pivotal Application Service? stack.watch will email you.
Affected Versions
Pivotal Application Service (PAS):- Version 2.3.x prior to 2.3.18 is affected.
- Version 2.4.x prior to 2.4.14 is affected.
- Version 2.5.x prior to 2.5.10 is affected.
- Version 2.6.x prior to 2.6.5 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.