CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2019-11275 – CSV Injection in usage report downloaded from Pivotal Application Manager
https://notcve.org/view.php?id=CVE-2019-11275
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege. Pivotal Application Manager, versiones 666.0.x anteriores a 666.0.36, versiones 667.0.x anteriores a 667.0.22, versiones 668.0.x anteriores a 668.0.21, versiones 669.0.x anteriores a 669.0.13 y versiones 670.0.x anteriores a 670.0.7, contienen una vulnerabilidad donde un usuario autenticado remoto puede crear una aplicación con un nombre tal que un programa csv pueda interpretar en una fórmula y ser ejecutado. El usuario malicioso puede conseguir acceso a un reporte de uso que requiere un mayor privilegio. • https://pivotal.io/security/cve-2019-11275 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11280 – Privilege escalation through the invitations service
https://notcve.org/view.php?id=CVE-2019-11280
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to. Pivotal Apps Manager, incluido en Pivotal Application Service versiones 2.3.x anteriores a 2.3.18, versiones 2.4.x anteriores a 2.4.14, versiones 2.5.x anteriores a 2.5.10 y versiones 2.6.x anteriores a 2.6.5, contiene un microservicio de invitaciones que permite a usuarios invitar a otros a sus organizaciones. Un usuario autenticado remoto puede alcanzar privilegios adicionales invitándolos a espacios a los que no deberían tener acceso. • https://pivotal.io/security/cve-2019-11280 • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11276 – Apps Manager sends tokens to Spring apps via HTTP
https://notcve.org/view.php?id=CVE-2019-11276
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attacker to read the type of access a user has over an app. They may also modify the logging level, potentially leading to lost information that would otherwise have been logged. Pivotal Apps Manager, incluido en Pivotal Application Service versiones 2.3.x anteriores a 2.3.16, versiones 2.4.x anteriores a 2.4.12, versiones 2.5.x anteriores a 2.5.8, y versiones 2.6.x anteriores a 2.6.3, realiza una petición al endpoint /cloudapplication por medio del actuador Spring, y las peticiones subsiguientes por medio de http no asegurado. Un usuario no autenticado adyacente podría detectar el tráfico de la red y conseguir acceso al token no cifrado que permite al atacante leer el tipo de acceso que presenta un usuario por medio de una aplicación. • https://pivotal.io/security/cve-2019-11276 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2019-11270 – UAA clients.write vulnerability
https://notcve.org/view.php?id=CVE-2019-11270
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess. Cloud Foundry UAA versiones anteriores a v73.4.0, contienen una vulnerabilidad en la que un cliente malicioso bajo posesión de la autoridad o el alcance "clients.write" puede omitir las restricciones impuestas a los clientes creados por medio de "clients.write" y crear clientes con alcances arbitrarios que no poseen. • https://pivotal.io/security/cve-2019-11270 https://www.cloudfoundry.org/blog/cve-2019-11270 • CWE-269: Improper Privilege Management CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3793 – Invitations Service supports HTTP connections
https://notcve.org/view.php?id=CVE-2019-3793
Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests. Pivotal Apps Manager Release, versiones 665.0.x anteriores a 665.0.28, versiones 666.0.x anteriores a 666.0.21, versiones 667.0.x anteriores a 667.0.7, presentan un servicio de invitación que acepta HTTP. Un usuario remoto no autenticado podría captar el tráfico de la red y lograr acceso a las credenciales de autorización usadas para realizar las solicitudes de invitación. • https://pivotal.io/security/cve-2019-3793 • CWE-300: Channel Accessible by Non-Endpoint CWE-319: Cleartext Transmission of Sensitive Information •