CVE-2018-11081: Pivotal Operations Manager UAA config - temp Ram Disk
First published: Fri Oct 05 2018(Updated: )
Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk..
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Software Operations Manager | >=1.11.0<1.12.25 | |
| Pivotal Software Operations Manager | >=2.0.0<2.0.16 | |
| Pivotal Software Operations Manager | >=2.1.0<2.1.11 | |
| Pivotal Software Operations Manager | >=2.2.0<2.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-11081?
CVE-2018-11081 is a vulnerability in Pivotal Operations Manager versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2 that exposes the Operations Manager UAA config directly onto disk.
What is the severity of CVE-2018-11081?
CVE-2018-11081 has a severity rating of 8.8 (high).
How does CVE-2018-11081 affect Pivotal Operations Manager?
CVE-2018-11081 affects Pivotal Operations Manager versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2 by failing to write the Operations Manager UAA config onto the temp RAM disk, exposing the configs directly onto disk.
Is there a fix for CVE-2018-11081?
Yes, updating to Pivotal Operations Manager versions 2.2.1, 2.1.11, 2.0.16, or later resolves CVE-2018-11081.
Where can I find more information about CVE-2018-11081?
You can find more information about CVE-2018-11081 at the following link: [https://pivotal.io/security/cve-2018-11081](https://pivotal.io/security/cve-2018-11081)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/tags
- agent/author
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- vendor/pivotal software
- canonical/pivotal software operations manager
- version/pivotal software operations manager/1.11.0
- version/pivotal software operations manager/2.0.0
- version/pivotal software operations manager/2.1.0
- version/pivotal software operations manager/2.2.0