CVE-2018-11044

6.5 mediumEPSS 0.7%

Medium (6.5) in pivotal software pivotal application service. EPSS 0.7% chance of exploitation in the next 30 days.

Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2018-07-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:pivotal_application_service

References

https://pivotal.io/security/cve-2018-11044
https://pivotal.io/security/cve-2018-11044

Check your stack JSON