CVE-2018-15759

On Demand Services SDK Timing Attack Vulnerability

State: Published
Severity: 9.1 Critical
Published: Nov 19, 2018
Updated: Sep 17, 2024
Reserved: Aug 23, 2018

Description

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.

Scores

CVSS	Score	Vector	Source
3.0	9.1 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	dell

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
On Demand Services SDKPivotal	all versions to before 0.24.0Affected

References

https://pivotal.io/security/cve-2018-15759
106019vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.