CVE-2018-15759

Published: Nov 19, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.

Affected (2)

Products: Pivotal Software: Broker Api, On Demand Services Sdk

Pivotal Software

2 products

On Demand Services Sdk

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Broker Api	Before 3.0.2
Pivotal Software On Demand Services Sdk	Before 0.24.0

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (4)

http://www.securityfocus.com/bid/106019

Source: security_alert@emc.com

Third Party AdvisoryVDB Entry

https://pivotal.io/security/cve-2018-15759

Source: security_alert@emc.com

Vendor Advisory

http://www.securityfocus.com/bid/106019

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://pivotal.io/security/cve-2018-15759

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.