CVE-2018-1195

Published: Mar 19, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

Affected (3)

Products: Cloudfoundry: Capi Release, Cf Deployment, Cf Release

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Capi Release	Before 1.46.0
Cloudfoundry Cf Deployment	Before 1.3.0
Cloudfoundry Cf Release	Before 283

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://www.cloudfoundry.org/blog/cve-2018-1195/

Source: security_alert@emc.com

Third Party Advisory

https://www.cloudfoundry.org/blog/cve-2018-1195/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.