What’s Vulnerable › Vulnerabilities

CVE-2018-15762: Pivotal Operations Manager gives all users heightened privileges

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-02 · updated 2026-06-17
• Weakness: CWE-269

Description

Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.

Affected products

• Pivotal Ops Manager: from 2.0.0 before 2.0.24; from 2.1.0 before 2.1.15; from 2.2.0 before 2.2.7; from 2.3.0 before 2.3.1 — fixed in 2.0.24, 2.1.15, 2.2.7, 2.3.1

How to fix

Upgrade to a fixed version: Pivotal Ops Manager 2.0.24, 2.1.15, 2.2.7, 2.3.1. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2018-15762
• https://pivotal.io/security/cve-2018-15762

Get alerted when CVE-2018-15762 or the next vulnerability affects your stack