PT-2018-10918 · Cloud Foundry · Cf-Deployment+2

CVE-2018-1195 · Publicado 2018-03-19 · Atualizado 2022-08-29

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Controller versions prior to 1.46.0 cf-deployment versions prior to 1.3.0 cf-release versions prior to 283

Description The issue allows refresh tokens to be used for authentication where access tokens are expected. This exposes a vulnerability where a refresh token, which would otherwise be insufficient to obtain an access token due to lack of client credentials or revocation, can be used to authenticate.

Recommendations For Cloud Controller versions prior to 1.46.0, update to version 1.46.0 or later to resolve the issue. For cf-deployment versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. For cf-release versions prior to 283, update to version 283 or later to resolve the issue.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2018-1195

Produtos afetados

Cloud Controller

Cf-Deployment

Cf-Release

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-1195 · Nota de Segurança
• https://cloudfoundry.org/blog/cve-2018-1195 · Nota
• https://osv.dev/vulnerability/CVE-2018-1195 · Aviso do Fabricante