CVE-2018-1256

    Dashboard / Vulnerabilities / CVE-2018-1256

    CVE-2018-1256

    Published: 7 May 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.

    References: https://pivotal.io/security/cve-2018-1256

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9531430217eb95f9c70e1728d0213b605ffbaa2c
    Fixed -None

    Affected versions

    2.1.2
    2.1.2.RELEASE

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-1256 | CVE-DB