CVE-2018-1195

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Mar 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-119507.8Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850 CVE-2018-119515.5Improper access control in core module lead XBL_LOADER performs the ZI region clear for QTEE instead of XBL_SEC in Snapdragon Mobile in vers CVE-2018-119527.8An image with a version lower than the fuse version may potentially be booted lead to improper authentication.CVE-2018-119539.8While processing ssid IE length from remote AP, possible out-of-bounds access may occur due to crafted ssid IE length in Snapdragon Auto, Sn CVE-2018-119559.8Lack of check on length of reason-code fetched from payload may lead driver access the memory not allocated to the frame and results in out CVE-2018-119567.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to device CVE-2018-119585.5Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Cons CVE-2018-11965.9Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The scri CVE-2018-119607.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition can oc CVE-2018-119617.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possibility of accessing out of b CVE-2018-119627.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Use-after-free issue in heap whil CVE-2018-119637.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Buffer overread may occur due to