PT-2018-10918 · Cloud Foundry · Cf-Deployment+2

Published 2018-03-19 · Updated 2022-08-29 · CVE-2018-1195

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Controller versions prior to 1.46.0 cf-deployment versions prior to 1.3.0 cf-release versions prior to 283

Description The issue allows refresh tokens to be used for authentication where access tokens are expected. This exposes a vulnerability where a refresh token, which would otherwise be insufficient to obtain an access token due to lack of client credentials or revocation, can be used to authenticate.

Recommendations For Cloud Controller versions prior to 1.46.0, update to version 1.46.0 or later to resolve the issue. For cf-deployment versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. For cf-release versions prior to 283, update to version 283 or later to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2018-1195

Affected Products

Cloud Controller

Cf-Deployment

Cf-Release

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-1195 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1195 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2018-1195 · Note