CVE Feed

    Dashboard / CVE / CVE-2018-1195

    CVE-2018-1195

    In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

    Published:Mar 19, 2018
    Last Modified:Nov 21, 2024
    EPS:Mar 19, 2018
    EPSS Score:0.00287
    CVSS Score:8.8

    Affected Products

    Vendor
    Cloudfoundry
    Product
    Capi-release
    Vendor
    Cloudfoundry
    Product
    Cf-deployment
    Vendor
    Cloudfoundry
    Product
    Cf-release

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-613 Insufficient Session Expiration

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2023-20881 (CVSS 8.1) — Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may ove…
    CVE-2021-22100 (CVSS 5.3) — In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a serv…
    CVE-2021-22101 (CVSS 7.5) — Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerabil…
    CVE-2021-22115 (CVSS 6.5) — Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logg…
    CVE-2020-5423 (CVSS 7.5) — CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an una…
    CVE-2020-5418 (CVSS 4.3) — Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "clou…
    CVE-2020-5417 (CVSS 8.8) — Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain…
    CVE-2020-5400 (CVSS 6.5) — Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they …
    CVE-2019-11294 (CVSS 4.3) — Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service …
    CVE-2019-3798 (CVSS 6) — Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when va…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High