CVE-2018-1195

State: Published
Severity: Not scored
Published: Mar 19, 2018
Updated: Sep 16, 2024
Reserved: Dec 6, 2017

Description

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Cloud ControllerDell EMC	You are using Cloud Controller version prior to 1.46.0Affected You are using cf-deployment version prior to 1.3.0Affected You are using cf-release version prior to 283Affected

References

https://www.cloudfoundry.org/blog/cve-2018-1195/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.