CVE-2018-11081 HIGH

CVE-2018-11081: Pivotal Operations Manager UAA config - temp Ram Disk

Vendor Pivotal
Product pivotal-ops-manager
Published October 5, 2018
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

7.9/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk..

Key dates

02Disclosure timeline

October 5, 2018 CVE published
September 17, 2024 Record updated