PT-2018-10895 · Pivotal · Pivotal Cloud Foundry+2

Publicado 2018-01-04 · Atualizado 2022-05-13 · CVE-2018-1190

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry versions prior to cf-release v270 UAA versions prior to v3.20.2 UAA bosh versions prior to v30.8 UAA bosh versions prior to v45.0

Description A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.

Recommendations For versions prior to cf-release v270, update to cf-release v270 or later. For UAA versions prior to v3.20.2, update to UAA v3.20.2 or later. For UAA bosh versions prior to v30.8, update to UAA bosh v30.8 or later. For UAA bosh versions prior to v45.0, update to UAA bosh v45.0 or later. As a temporary workaround, consider restricting access to the UAA OpenID Connect check session iframe endpoint to minimize the risk of exploitation. Avoid using the clientId parameter in the affected endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1190

GHSA-J97Q-9XP9-G5FX

Produtos afetados

Pivotal Cloud Foundry

Uaa

Uaa Bosh

Referências · 9

• https://github.com/cloudfoundry/uaa · Nota
• https://github.com/cloudfoundry/uaa/commit/96fe26711f8f8855d2994a531447f730afd61844 · Nota
• https://osv.dev/vulnerability/GHSA-j97q-9xp9-g5fx · Aviso do Fabricante
• https://t.me/cvenotify/14975 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-1190 · Nota de Segurança
• https://cloudfoundry.org/cve-2018-1190 · Aviso do Fabricante
• https://web.archive.org/web/20200227133214/http://securityfocus.com/bid/102427 · Nota
• http://securityfocus.com/bid/102427 · Nota
• https://osv.dev/vulnerability/CVE-2018-1190 · Aviso do Fabricante