CVE-2018-1192: pivotal_software cloud_foundry_cf-deployment
Vulnerability summary
CVE-2018-1192 is a high (CVSS 8.8) vulnerability in pivotal_software cloud_foundry_cf-deployment. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.6% of scored vulnerabilities.
Timeline
- 01-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.01%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.01% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pivotal_software4 products
- cloud_foundry_cf-deployment< 1.7
- cloud_foundry_cf-release< 285
- cloud_foundry_uaa≥ 4.5.0, < 4.5.5 | ≥ 4.7.0, < 4.7.4 | ≥ 4.8.0, < 4.8.3
- cloud_foundry_uaa-release45.7 | 52.7 | 53.3
Org.cloudfoundry.identity1 product
- cloudfoundry-identity-server< 4.5.5 | ≥ 4.6.0, < 4.7.4 | ≥ 4.8.0, < 4.8.3
2 vendors · 5 products
References
7 links
- github.com/cloudfoundry/uaaPACKAGE