What’s Vulnerable › Vulnerabilities

CVE-2018-15759: On Demand Services SDK Timing Attack Vulnerability

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-19 · updated 2026-06-17
• Weakness: CWE-307

Description

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.

Affected products

• Pivotal Software Broker Api: before 3.0.2 — fixed in 3.0.2
• Pivotal On Demand Services SDK: before 0.24.0 — fixed in 0.24.0

How to fix

Upgrade to a fixed version: Pivotal Software Broker Api 3.0.2; Pivotal On Demand Services SDK 0.24.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/106019
• https://pivotal.io/security/cve-2018-15759
• http://www.securityfocus.com/bid/106019
• https://pivotal.io/security/cve-2018-15759

Get alerted when CVE-2018-15759 or the next vulnerability affects your stack