VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jul 24, 2018· Updated Jun 17, 2026

CVE-2018-11044

CVE-2018-11044

Description

Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.

Affected products

3
  • Pivotal/Pivotal Application Servicev5
    Range: 2.2.x
  • Pivot/Ops Managerllm-fuzzy
    Range: >=1.12.0, <1.12.26 || >=2.0.0, <2.0.17 || >=2.1.0, <2.1.8 || >=2.2.0, <2.2.1
  • Cloudfoundry/Pivotal Application Service
    cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*
    Range: >=1.12.0,<1.12.26

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.