What’s Vulnerable › Vulnerabilities

CVE-2019-11280: Privilege escalation through the invitations service

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-20 · updated 2026-06-17
• Weakness: CWE-269

Description

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.

Affected products

• Pivotal Application Service: from 2.3.0 before 2.3.18; from 2.4.0 before 2.4.14; from 2.5.0 before 2.5.10; from 2.6.0 before 2.6.5 — fixed in 2.3.18, 2.4.14, 2.5.10, 2.6.5

How to fix

Upgrade to a fixed version: Pivotal Application Service 2.3.18, 2.4.14, 2.5.10, 2.6.5. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2019-11280
• https://pivotal.io/security/cve-2019-11280

Get alerted when CVE-2019-11280 or the next vulnerability affects your stack