Description
Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pivotal | Pivotal Application Service | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2018-3089 | Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email. |
References
| Link | Providers |
|---|---|
| https://pivotal.io/security/cve-2018-11044 |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: dell
Published:
Updated: 2024-09-16T21:02:31.767Z
Reserved: 2018-05-14T00:00:00.000Z
Link: CVE-2018-11044
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-07-24T19:29:00.240
Modified: 2024-11-21T03:42:33.310
Link: CVE-2018-11044
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses