CVE-2018-15759

9.8 criticalEPSS 1.7%

Critical (9.8) in pivotal software. EPSS 1.7% chance of exploitation in the next 30 days.

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2018-11-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:broker_api
pivotal_software:on_demand_services_sdk

References

http://www.securityfocus.com/bid/106019
https://pivotal.io/security/cve-2018-15759
http://www.securityfocus.com/bid/106019
https://pivotal.io/security/cve-2018-15759

Check your stack JSON