HIGH🇵🇱 Wersja polska

CVE-2018-1192

CVSS 8.8v3.0pub. 2018-02-01upd. 2024-11-21

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Pivotal Software Cloud Foundry Cf Deployment

    APP
    Pivotal Software
    < 1.7

  • Pivotal Software Cloud Foundry Cf Release

    APP
    Pivotal Software
    < 285

  • Pivotal Software Cloud Foundry Uaa

    APP
    Pivotal Software
    4.8.0 – 4.8.3 (excl.)4.5.0 – 4.5.5 (excl.)4.7.0 – 4.7.4 (excl.)

  • Pivotal Software Cloud Foundry Uaa Release

    APP
    Pivotal Software
    45.752.753.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-15761CRITICAL9.9PL ✓same product

Privilege escalation w Cloud Foundry UAA poprzez manipulację stroną zgody

CVE-2015-5171CRITICAL9.8PL ✓same product

Cloud Foundry: brak unieważniania sesji po zmianie hasła

CVE-2015-5172CRITICAL9.8PL ✓same product

Cloud Foundry: brak wygasania linków resetowania hasła

CVE-2017-4992CRITICAL9.8PL ✓same product

Cloud Foundry UAA: privilege escalation przez mechanizm zaproszeń użytkowników

CVE-2016-6637CRITICAL9.6PL ✓same product

CSRF w Pivotal Cloud Foundry UAA — przejęcie uprawnień użytkownika