CVE-2018-1268

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests to read from or write to the logs of that app.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-126807.5The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service inCVE-2018-126847.1Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or InfCVE-2018-126877.5tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.CVE-2018-126889.8tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.CVE-2018-126899.8phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and paCVE-2018-12696.5Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior toCVE-2018-126916.8Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier aCVE-2018-126928.8TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell meCVE-2018-126936.5Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a CVE-2018-126947.5TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/rebooCVE-2018-126956.1mao10cms 6 allows XSS via the m=bbs&a=index page.CVE-2018-126966.1mao10cms 6 allows XSS via the article page.
CVE-2018-1268: Medium severity, CVSS 6.8 | Vulnix