CVE-2019-11280

8.8 highEPSS 1.5%

High (8.8) in pivotal software pivotal application service. EPSS 1.5% chance of exploitation in the next 30 days.

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2019-09-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:pivotal_application_service

References

https://pivotal.io/security/cve-2019-11280
https://pivotal.io/security/cve-2019-11280

Check your stack JSON