CVE-2018-1278: pivotal_software pivotal_application_service Incorrect Authorization
Vulnerability summary
CVE-2018-1278 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in pivotal_software pivotal_application_service. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.6% of scored vulnerabilities.
Timeline
- 11-05-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas and other information about the org.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.24%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.24% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pivotal1 product
- pivotal application service1.12.x prior to 1.12.22 and 2.0.x prior to 2.0.13 and 2.1.x prior to 2.1.4
Pivotal_software1 product
- pivotal_application_service≥ 1.12.0, < 1.12.22 | ≥ 2.0.0, < 2.0.13 | ≥ 2.1.0, < 2.1.4
2 vendors · 2 products