CVEvulnerability

CVE-2018-1192

8.8 HIGH Published 2018-02-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-02-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-200

Description

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.

Affected configurations

• pivotal software cloud foundry uaa (>= 4.5.0 < 4.5.5) • pivotal software cloud foundry uaa (>= 4.7.0 < 4.7.4) • pivotal software cloud foundry uaa (>= 4.8.0 < 4.8.3) • pivotal software cloud foundry uaa-release 45.7 • pivotal software cloud foundry uaa-release 52.7 • pivotal software cloud foundry uaa-release 53.3 • pivotal software cloud foundry cf-release (< 285) • pivotal software cloud foundry cf-deployment (< 1.7)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References