CVE-2018-11044

Name of the Vulnerable Software and Affected Versions Pivotal Apps Manager included in Pivotal Application Service versions 2.2.x prior to 2.2.1 Pivotal Apps Manager included in Pivotal Application Service versions 2.1.x prior to 2.1.8 Pivotal Apps Manager included in Pivotal Application Service versions 2.0.x prior to 2.0.17 Pivotal Apps Manager included in Pivotal Application Service versions 1.12.x prior to 1.12.26

Description The issue concerns the failure to escape all user-provided content when sending invitation emails. This allows a malicious authenticated user to inject content into an invite to another user, exploiting the trust implied by the source of the email.

Recommendations For versions 2.2.x prior to 2.2.1, update to version 2.2.1 or later. For versions 2.1.x prior to 2.1.8, update to version 2.1.8 or later. For versions 2.0.x prior to 2.0.17, update to version 2.0.17 or later. For versions 1.12.x prior to 1.12.26, update to version 1.12.26 or later.