CSV Injection in usage report downloaded from Pivotal Application Manager
Priority LOW 22CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.
Why it matters now
EPSS 0.01068 65th percentileScored 2026-11-07
Fix Fixed Apps Manager (Pivotal): 670.0.7, 669.0.13, 668.0.21 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pivotal | Apps Manager | 670 to before 670.0.7; 669 to before 669.0.13; 668 to before 668.0.21; 667 to before 667.0.22; 666 to before 666.0.36 | 670.0.7, 669.0.13, 668.0.21, 667.0.22, 666.0.36 | Patch available | CNA |
- Apps Manager VendorPivotal Affected 670 to before 670.0.7; 669 to before 669.0.13; 668 to before 668.0.21; 667 to before 667.0.22; 666 to before 666.0.36 Fixed in 670.0.7, 669.0.13, 668.0.21, 667.0.22, 666.0.36 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:* | 666.0.0 to before 666.0.36; 667.0.0 to before 667.0.22; 668.0.0 to before 668.0.21; 669.0.0 to before 669.0.13; 670.0.0 to before 670.0.7 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:* | 2.3.0 – 2.3.18; 2.4.0 – 2.4.14; 2.5.0 – 2.5.1; 2.6.0 – 2.6.5 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:pivotal:apps_manager:*:*:*:*:*:*:*:* Versions 666.0.0 to before 666.0.36; 667.0.0 to before 667.0.22; 668.0.0 to before 668.0.21; 669.0.0 to before 669.0.13; 670.0.0 to before 670.0.7 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal_software:pivotal_application_service:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.3.18; 2.4.0 – 2.4.14; 2.5.0 – 2.5.1; 2.6.0 – 2.6.5 Vulnerable ·Spring by Pivotal
Remediation
- Fix · CNA Apps Manager (Pivotal) Fixed in 670.0.7, 669.0.13, 668.0.21, 667.0.22, 666.0.36
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11275
- 2026-10-03 Alias added: GHSA-8h39-8pc2-83q7
References
Sources
- CVE-2019-11275 · CVE Program
- CVE-2019-11275 · NVD
- FIRST EPSS
- GHSA-8h39-8pc2-83q7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences