CWE Code: 732
Vulnerability Type: privilege_escalation
CVSS Score: 4.0
CWE Name:  Incorrect Permission Assignment for Critical Resource
Summary: pivotal application manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. the malicious user can possibly gain access to a usage report that requires a higher privilege.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-10-01
Last Modified Date: 2019-10-09