{"id":"CVE-2018-11088","published":"2018-09-17T16:00:00Z","modified":"2024-09-17T03:14:36Z","title":"Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and…","vendor":"Pivotal","product":"Application Service","tier":"core","eol":null,"affectedVersions":[{"vendor":"Pivotal","product":"Application Service","versions":[">= 2.0, < 2.0.21",">= 2.1, < 2.1.13",">= 2.2, < 2.2.5"]}],"description":{"text":"Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.00961,"percentile":0.61492,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://pivotal.io/security/cve-2018-11088","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-3131","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-3131","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1552"],"provenance":"source"},{"stage":"secondary","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2018-09-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-11088","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":12.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.3,"detail":"percentile 0.6149"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}