CVE-2018-1276

Published: May 17, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted commands to read the IaaS metadata from the VM, which may contain BOSH credentials.

Affected (1)

Products: Pivotal Software: Windows Stemcells

Pivotal Software

1 product

Windows Stemcells

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Windows Stemcells	Before 1200.17

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://www.cloudfoundry.org/blog/cve-2018-1276/

Source: security_alert@emc.com

Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2018-1276/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.