Description
In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dell EMC | Cloud Controller | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2018-11831 | In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication. |
References
| Link | Providers |
|---|---|
| https://www.cloudfoundry.org/blog/cve-2018-1195/ |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: dell
Published:
Updated: 2024-09-16T20:52:50.610Z
Reserved: 2017-12-06T00:00:00.000Z
Link: CVE-2018-1195
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-03-19T18:29:00.327
Modified: 2024-11-21T03:59:22.380
Link: CVE-2018-1195
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses