Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1192

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.

Published

2018-02-01T20:29:00.247

Last Modified

2024-11-21T03:59:22.137

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application pivotal_software cloud_foundry_uaa < 4.5.5 Yes
Application pivotal_software cloud_foundry_uaa < 4.7.4 Yes
Application pivotal_software cloud_foundry_uaa < 4.8.3 Yes
Application pivotal_software cloud_foundry_uaa-release 45.7 Yes
Application pivotal_software cloud_foundry_uaa-release 52.7 Yes
Application pivotal_software cloud_foundry_uaa-release 53.3 Yes
Application pivotal_software cloud_foundry_cf-release < 285 Yes
Application pivotal_software cloud_foundry_cf-deployment < 1.7 Yes
References