title: Reflected XSS in Pivotal Operations Manager
description: Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.
problem types: CWE-79: Cross-site Scripting (XSS) - Reflected
affected:
{
product: Pivotal Ops Manager
vendor: Pivotal
versions:
lessThan: 2.2.16, status: affected, version: 2.2, versionType: custom
lessThan: 2.3.10, status: affected, version: 2.3, versionType: custom
lessThan: 2.4.3, status: affected, version: 2.4, versionType: custom
lessThan: 2.1.19, status: affected, version: 2.1, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L
version: 3.0
]