CVE-2018-11044

State: Published
Severity: Not scored
Published: Jul 24, 2018
Updated: Sep 16, 2024
Reserved: May 14, 2018

Description

Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Pivotal Application ServicePivotal	2.2.x to before 2.2.1Affected 2.1.x to before 2.1.8Affected 2.0.x to before 2.0.17Affected 1.12.x to before 1.12.26Affected

References

https://pivotal.io/security/cve-2018-11044

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.