VYPR
← All advisories
High severity8.8NVD Advisory· Published Sep 20, 2019· Updated Jun 17, 2026

CVE-2019-11280

CVE-2019-11280

Description

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.

Affected products

4
  • Pivotal/Pivotal Application Service (PAS)v5
    Range: 2.3.x prior to 2.3.18
  • Pivot/Ops Managerllm-fuzzy
    Range: 2.3.x < 2.3.18, 2.4.x < 2.4.14, 2.5.x < 2.5.10, 2.6.x < 2.6.5
  • Pivot/Pivotllm-fuzzy
    Range: 2.3.x < 2.3.18, 2.4.x < 2.4.14, 2.5.x < 2.5.10, 2.6.x < 2.6.5
  • Cloudfoundry/Pivotal Application Service
    cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*
    Range: >=2.3.0,<2.3.18

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.