PT-2018-10928 · Microsoft · Windows Stemcells

Published 2018-03-19 · Updated 2019-10-03 · CVE-2018-1197

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Stemcells versions prior to 1200.14

Description The issue allows apps running inside containers in Windows on Google Cloud Platform to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials.

Recommendations For Windows Stemcells versions prior to 1200.14, update to version 1200.14 or later to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-1197

Affected Products

Windows Stemcells

References · 3

• https://cloudfoundry.org/blog/cve-2018-1197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1197 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1197 · Vendor Advisory