CVE-2018-1278: Medium severity pivotal application service vulnerability
Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas and other information about the org.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1278?
CVE-2018-1278 is an authorization enforcement vulnerability in Apps Manager included in Pivotal Application Service versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4.
What is the severity of CVE-2018-1278?
The severity of CVE-2018-1278 is medium, with a severity value of 6.5.
How does CVE-2018-1278 affect Pivotal Application Service?
CVE-2018-1278 affects Pivotal Application Service versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 by allowing a member of any org to create invitations to any org for which the org GUID can be discovered.
How can I fix CVE-2018-1278?
To fix CVE-2018-1278, update Pivotal Application Service to version 1.12.22 or later for 1.12.x, version 2.0.13 or later for 2.0.x, or version 2.1.4 or later for 2.1.x.
Where can I find more information about CVE-2018-1278?
You can find more information about CVE-2018-1278 at the following references: [http://www.securityfocus.com/bid/104227](http://www.securityfocus.com/bid/104227) and [https://pivotal.io/security/cve-2018-1278](https://pivotal.io/security/cve-2018-1278).