Pivotal Software Windows Stemcells vulnerabilities

2 CVEs affecting Pivotal Software Windows Stemcells, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1276, published 2018-05-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1276, published 2018-05-17. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted commands to read the…
CVE-2018-1197, published 2018-03-19. High severity, CVSS 8.5. EPSS: 0.6% chance of exploitation in the next 30 days. In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this…