High severity · published Oct 5, 2018
CVE-2018-15763
Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs
8.8
CVSS
1%
EPSS
No
On KEV
Description
Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A malicious user with access to application logs may be able to obtain IaaS credentials and perform actions using these credentials.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Pivotal Container Service · Pivotal Software
before 1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15763
Vendor Advisory
https://pivotal.io/security/cve-2018-15763
More from Pivotal Container Service
4.3
CVE-2019-11273
Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the…