CVE-2018-1195
High
Description
In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.
SeverityHigh
CVSS8.8
Exploit probability62. percentile1%
ProductCloudfoundry Cf-deployment
PublishedMar 19, 2018
First seenMar 19, 2018
How to fix
Update
- cloudfoundry cf-deployment1.3.0 or later
- cloudfoundry capi-release1.46.0 or later
- cloudfoundry cf-release283 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-deployment | v < 1.3.0 | 1.3.0 |
| cloudfoundry capi-release | v < 1.46.0 | 1.46.0 |
| cloudfoundry cf-release | v < 283 | 283 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.