[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOcjI8oQLu7teNDt0IGg1WopY3enpoDafHiME-c_A2ig":3,"g5a-risk:CVE-2019-11275":162},{"success":4,"data":5,"meta":160},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":49,"epssPercentile":26,"epssTimeSeries":50,"severity":51,"affectedProducts":52,"affectedProductsCount":62,"references":63,"referencesCount":69,"weaknesses":70,"weaknessesCount":62,"isActivelyExploited":85,"cisaInfo":26,"otxData":26,"relatedBlogPosts":86,"seoMetadata":87,"configurations":112,"relatedVendorCves":158,"notableEvents":159},"CVE-2019-11275","What is CVE-2019-11275?","Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.","Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x pri...","2019-10-01T15:15:11.65","2020-10-16T13:17:34.117",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":39,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","MEDIUM",null,2.8,1.4,[30],{"Source":31,"Type":32,"CVSSData":33,"ExploitabilityScore":38,"ImpactScore":28},"security@pivotal.io","Secondary",{"Version":34,"VectorString":35,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":36,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":37,"BaseSeverity":22,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.0","CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N","REQUIRED",3.5,2.1,[40],{"Source":17,"Type":18,"CVSSData":41,"BaseSeverity":25,"ExploitabilityScore":47,"ImpactScore":48,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":42,"VectorString":43,"AccessVector":21,"AccessComplexity":22,"Authentication":44,"ConfidentialityImpact":45,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":46,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:S\u002FC:P\u002FI:N\u002FA:N","SINGLE","PARTIAL",4,8,2.9,0.01068,[49,49,49,49,49,49,49],"Medium",[53,58],{"vendor":54,"product":55,"version":56,"criteria":57,"vulnerable":4},"pivotal","apps_manager","*","cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:*",{"vendor":59,"product":60,"version":56,"criteria":61,"vulnerable":4},"pivotal_software","pivotal_application_service","cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:*",2,[64],{"url":65,"source":66,"tags":67},"https:\u002F\u002Fpivotal.io\u002Fsecurity\u002Fcve-2019-11275","Pivotal",[68],"Vendor Advisory",1,[71,79],{"id":72,"name":73,"description":74,"extendedDescription":75,"status":76,"abstraction":77,"structure":78},"CWE-74","Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.","Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.","Incomplete","Class","Simple",{"id":80,"name":81,"description":82,"extendedDescription":83,"status":76,"abstraction":84,"structure":78},"CWE-1236","Improper Neutralization of Formula Elements in a CSV File","The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.","User-provided data is often saved to traditional databases.  This data can be exported to a CSV file, which allows users to read the data using spreadsheet software such as Excel, Numbers, or Calc.  This software interprets entries beginning with '=' as formulas, which are then executed by the spreadsheet software.  The software's formula language often allows methods to access hyperlinks or the local command line, and frequently allows enough characters to invoke an entire script. Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.","Base",false,[],{"title":88,"metaDescription":89,"keywords":90,"canonicalUrl":91,"structuredData":92},"What is CVE-2019-11275? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2019-11275, a medium severity cyber security vulnerability from 2019. Pivotal Application Manager, versions 666.0.x prior to 66...","CVE-2019-11275, CVE-2019-11275 vulnerability, CVE-2019-11275 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2019, CVSS score, exploit, patch, remediation, pivotal security, pivotal_software security, apps_manager vulnerability, pivotal_application_service vulnerability","\u002Fwhat-is\u002Fcve-2019-11275",{"@context":93,"@type":94,"headline":88,"description":89,"datePublished":10,"dateModified":11,"author":95,"publisher":99,"about":103,"mainEntityOfPage":107,"articleSection":110,"keywords":111},"https:\u002F\u002Fschema.org","TechArticle",{"@type":96,"name":97,"url":98},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":96,"name":97,"url":98,"logo":100},{"@type":101,"url":102},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":104,"name":6,"description":105,"additionalType":106},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":108,"@id":109},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2019-11275","Cybersecurity","CVE-2019-11275, CVE-2019-11275 vulnerability, CVE-2019-11275 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[113,138],{"Operator":26,"Negate":26,"Nodes":114},[115],{"Operator":116,"Negate":26,"CPEMatch":117},"OR",[118,122,126,130,134],{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":119,"VersionStartExcluding":26,"VersionStartIncluding":120,"VersionEndExcluding":121,"VersionEndIncluding":26},"D44F12A8-BB85-4F47-9422-0C5070B1554B","666.0.0","666.0.36",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":123,"VersionStartExcluding":26,"VersionStartIncluding":124,"VersionEndExcluding":125,"VersionEndIncluding":26},"279FE72A-4CD1-436D-A069-FAB0A70166DA","667.0.0","667.0.22",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":127,"VersionStartExcluding":26,"VersionStartIncluding":128,"VersionEndExcluding":129,"VersionEndIncluding":26},"CFC5E0B9-2897-432B-9972-7C66372E7998","668.0.0","668.0.21",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":131,"VersionStartExcluding":26,"VersionStartIncluding":132,"VersionEndExcluding":133,"VersionEndIncluding":26},"FFBF0CCE-5C54-4DBA-A784-054ED1FEE142","669.0.0","669.0.13",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":135,"VersionStartExcluding":26,"VersionStartIncluding":136,"VersionEndExcluding":137,"VersionEndIncluding":26},"6D0D669E-2444-43F3-B3FA-1BEB3AF063D1","670.0.0","670.0.7",{"Operator":26,"Negate":26,"Nodes":139},[140],{"Operator":116,"Negate":26,"CPEMatch":141},[142,146,150,154],{"Vulnerable":4,"Criteria":61,"MatchCriteriaID":143,"VersionStartExcluding":26,"VersionStartIncluding":144,"VersionEndExcluding":26,"VersionEndIncluding":145},"B355FF03-4AEE-46CF-A357-60E28D6BE1C9","2.3.0","2.3.18",{"Vulnerable":4,"Criteria":61,"MatchCriteriaID":147,"VersionStartExcluding":26,"VersionStartIncluding":148,"VersionEndExcluding":26,"VersionEndIncluding":149},"799BBFDE-7A92-4976-B823-F06D37D27312","2.4.0","2.4.14",{"Vulnerable":4,"Criteria":61,"MatchCriteriaID":151,"VersionStartExcluding":26,"VersionStartIncluding":152,"VersionEndExcluding":26,"VersionEndIncluding":153},"8198778A-7E47-4927-83FB-3C52F8C8EC8F","2.5.0","2.5.1",{"Vulnerable":4,"Criteria":61,"MatchCriteriaID":155,"VersionStartExcluding":26,"VersionStartIncluding":156,"VersionEndExcluding":26,"VersionEndIncluding":157},"828C8237-0F42-46F0-BC25-C232016A8B93","2.6.0","2.6.5",[],[],{"lastModified":11,"cacheTime":161,"version":42},1792372478202,{"score":163,"band":164,"action":165,"scoredAt":166},20,"Low","Monitor","2026-10-16T06:46:59.342182+00:00"]