CVE-2018-1278
First published: Fri May 11 2018(Updated: )
Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas and other information about the org.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Software Pivotal Application Service | >=1.12.0<1.12.22 | |
| Pivotal Software Pivotal Application Service | >=2.0.0<2.0.13 | |
| Pivotal Software Pivotal Application Service | >=2.1.0<2.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2018-1278?
CVE-2018-1278 is an authorization enforcement vulnerability in Apps Manager included in Pivotal Application Service versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4.
What is the severity of CVE-2018-1278?
The severity of CVE-2018-1278 is medium, with a severity value of 6.5.
How does CVE-2018-1278 affect Pivotal Application Service?
CVE-2018-1278 affects Pivotal Application Service versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 by allowing a member of any org to create invitations to any org for which the org GUID can be discovered.
How can I fix CVE-2018-1278?
To fix CVE-2018-1278, update Pivotal Application Service to version 1.12.22 or later for 1.12.x, version 2.0.13 or later for 2.0.x, or version 2.1.4 or later for 2.1.x.
Where can I find more information about CVE-2018-1278?
You can find more information about CVE-2018-1278 at the following references: [http://www.securityfocus.com/bid/104227](http://www.securityfocus.com/bid/104227) and [https://pivotal.io/security/cve-2018-1278](https://pivotal.io/security/cve-2018-1278).
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/pivotal software
- canonical/pivotal software pivotal application service
- version/pivotal software pivotal application service/1.12.0
- version/pivotal software pivotal application service/2.0.0
- version/pivotal software pivotal application service/2.1.0