CVE-2018-15762

Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.

Score

CVSS 3.0 9.0 Critical

Status

Modified - security_alert@emc.com

Published

2018-11-02

Last modified

2024-09-16

Weaknesses

CWE-269, CWE-285

Affected products

• Pivotal Operations Manager (Pivotal Cloud Foundry)
• Operations Manager (Pivotal Software)

References

• https://pivotal.io/security/cve-2018-15762