CVE-2019-11280: Privilege escalation through the invitations service
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-11280?
CVE-2019-11280 is a vulnerability in Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5.
How severe is CVE-2019-11280?
CVE-2019-11280 has a severity rating of 8.8 (high).
What is the affected software for CVE-2019-11280?
The affected software for CVE-2019-11280 is Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5.
How can a remote authenticated user exploit CVE-2019-11280?
A remote authenticated user can gain unauthorized access to organizations by exploiting the invitations microservice in Pivotal Apps Manager.
Where can I find more information about CVE-2019-11280?
You can find more information about CVE-2019-11280 at the following link: [Pivotal Security Advisory](https://pivotal.io/security/cve-2019-11280)