CVE-2018-1268

Published: Jun 6, 2018Modified: Nov 21, 2024

6.8

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.6 / Impact: 5.2

Source: NVD

Description

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests to read from or write to the logs of that app.

Affected (5)

Products: Cloudfoundry: Loggregator

Cloudfoundry

1 product

Loggregator

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Loggregator	101 ≤ version < 101.9
Cloudfoundry Loggregator	102 ≤ version < 102.2
Cloudfoundry Loggregator	89 ≤ version < 89.5
Cloudfoundry Loggregator	96 ≤ version < 96.1
Cloudfoundry Loggregator	99 ≤ version < 99.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://www.cloudfoundry.org/blog/cve-2018-1268

Source: security_alert@emc.com

Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2018-1268

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.