CVE-2018-1192

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; a	Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3

References

https://www.cloudfoundry.org/blog/cve-2018-1192/Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2018-1192/Vendor Advisory

Timeline

Published: Feb 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-119217.8Failure condition is not handled properly and the correct error code is not returned. It could cause unintended SUI behavior and create unin CVE-2018-119225.5Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.CVE-2018-119237.8Improper buffer length check before copying can lead to integer overflow and then a buffer overflow in WMA event handler in Snapdragon Auto,CVE-2018-119247.8Improper buffer length validation in WLAN function can lead to a potential integer oveflow issue in Snapdragon Auto, Snapdragon Compute, Sna CVE-2018-119257.8Data length received from firmware is not validated against the max allowed size which can result in buffer overflow. in Snapdragon Auto, Sn CVE-2018-119277.8Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from f CVE-2018-119287.8Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, Snapdragon CVE-2018-119297.8Lack of input validation in WLAN function can lead to potential heap overflow in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indust CVE-2018-11935.3Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can CVE-2018-119309.8Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer t CVE-2018-119317.8Improper access to HLOS is possible while transferring memory to CPZ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr CVE-2018-119329.1Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,