CVE-2018-1192: Infoleak
First published: Thu Feb 01 2018(Updated: )
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.
Credit: security_alert@emc.com security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Software Cloud Foundry Uaa | >=4.5.0<4.5.5 | |
| Pivotal Software Cloud Foundry Uaa | >=4.7.0<4.7.4 | |
| Pivotal Software Cloud Foundry Uaa | >=4.8.0<4.8.3 | |
| Pivotal Software Cloud Foundry Uaa-release | =45.7 | |
| Pivotal Software Cloud Foundry Uaa-release | =52.7 | |
| Pivotal Software Cloud Foundry Uaa-release | =53.3 | |
| Pivotal Software Cloud Foundry Cf-release | <285 | |
| Pivotal Software Cloud Foundry Cf-deployment | <1.7 | |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=4.8.0<4.8.3 | 4.8.3 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=4.6.0<4.7.4 | 4.7.4 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | <4.5.5 | 4.5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cloudfoundry.org/blog/cve-2018-1192/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1192
- https://github.com/cloudfoundry/uaa/commit/1f529fcb43fd200cab10587e889343ef1683c6e6
- https://github.com/cloudfoundry/uaa/commit/599391fe5d564c7e4860b8a6ec17cda872a822a3
- https://github.com/cloudfoundry/uaa/commit/a61bfabbad22f646ecf1f00016b448b26a60daf
- https://www.cloudfoundry.org/blog/cve-2018-1192
- https://github.com/advisories/GHSA-xg5v-696h-c3vr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2018-1192?
The severity of CVE-2018-1192 is high.
What is the affected software for CVE-2018-1192?
The affected software for CVE-2018-1192 is Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3.
What is the description of CVE-2018-1192?
CVE-2018-1192 is a vulnerability in Cloud Foundry Foundation, cf-release, and UAA that allows remote attackers to bypass authorization and gain access to unauthorized resources.
How can I fix CVE-2018-1192?
To fix CVE-2018-1192, it is recommended to upgrade to cf-release v285 or later, cf-deployment v1.7 or later, UAA 4.5.5, 4.8.3, or 4.7.4, and UAA-release 45.7, 52.7, or 53.3. Additionally, follow the recommendations provided by Cloud Foundry Foundation.
Where can I find more information about CVE-2018-1192?
More information about CVE-2018-1192 can be found at the following link: [https://www.cloudfoundry.org/blog/cve-2018-1192/](https://www.cloudfoundry.org/blog/cve-2018-1192/)
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xg5v-696h-c3vr
- alias/CVE-2018-1192
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/pivotal software
- canonical/pivotal software cloud foundry uaa
- version/pivotal software cloud foundry uaa/4.5.0
- version/pivotal software cloud foundry uaa/4.7.0
- version/pivotal software cloud foundry uaa/4.8.0
- canonical/pivotal software cloud foundry uaa-release
- version/pivotal software cloud foundry uaa-release/45.7
- version/pivotal software cloud foundry uaa-release/52.7
- version/pivotal software cloud foundry uaa-release/53.3
- canonical/pivotal software cloud foundry cf-release
- canonical/pivotal software cloud foundry cf-deployment
- package-manager/maven