CVE-2018-1192: Infoleak
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1192?
The severity of CVE-2018-1192 is high.
What is the affected software for CVE-2018-1192?
The affected software for CVE-2018-1192 is Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3.
What is the description of CVE-2018-1192?
CVE-2018-1192 is a vulnerability in Cloud Foundry Foundation, cf-release, and UAA that allows remote attackers to bypass authorization and gain access to unauthorized resources.
How can I fix CVE-2018-1192?
To fix CVE-2018-1192, it is recommended to upgrade to cf-release v285 or later, cf-deployment v1.7 or later, UAA 4.5.5, 4.8.3, or 4.7.4, and UAA-release 45.7, 52.7, or 53.3. Additionally, follow the recommendations provided by Cloud Foundry Foundation.
Where can I find more information about CVE-2018-1192?
More information about CVE-2018-1192 can be found at the following link: [https://www.cloudfoundry.org/blog/cve-2018-1192/](https://www.cloudfoundry.org/blog/cve-2018-1192/)