CVE-2019-11273 : Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable

Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able to retrieve non-sensitive information.

Published 2019-07-23 23:15:36

Updated 2020-10-07 12:27:19

Source Pivotal Software, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-11273

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-11273

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
2.2	LOW	CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N	0.7	1.4	Pivotal Software, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2019-11273

CWE-532 Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Assigned by:

nvd@nist.gov (Primary)
security@pivotal.io (Secondary)

Products affected by CVE-2019-11273

Pivotal Software » Pivotal Container Service
Versions from including (>=) 1.4.0 and before (<) 1.4.1
cpe:2.3:a:pivotal_software:pivotal_container_service:*:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Pivotal Container Service
Versions from including (>=) 1.3.0 and before (<) 1.3.7
cpe:2.3:a:pivotal_software:pivotal_container_service:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2019-11273

Exploit prediction scoring system (EPSS) score for CVE-2019-11273

CVSS scores for CVE-2019-11273

CWE ids for CVE-2019-11273

References for CVE-2019-11273

Products affected by CVE-2019-11273