Cross-Site Scripting Vulnerability in Pivotal Cloud Foundry's UAA Component
CVE-2018-1190

6.1MEDIUM

Key Information:

Vendor

Pivotal

Status
Pivotal Cloud Foundry Products: All Versions Prior To Cf-release V270, Uaa V3.x Prior To V3.20.2, And Uaa Bosh V30.x Versions Prior To V30.8 And All Other Versions Prior To V45.0
Vendor
CVE Published:
4 January 2018

What is CVE-2018-1190?

An issue has been identified in Pivotal Cloud Foundry products, where a cross-site scripting (XSS) vulnerability exists in the clientId parameter of requests to the UAA OpenID Connect check session iframe endpoint. This vulnerability compromises the integrity of single logout session management, potentially allowing attackers to execute arbitrary scripts in the context of logged-in users. It is essential for users to upgrade their deployments to secure versions to mitigate this risk.

Affected Version(s)

Pivotal Cloud Foundry products: all prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x prior to v30.8 and all other prior to v45.0 Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0

References

http://www.securityfocus.com/bid/102427
vdb-entryx_refsource_BID
https://www.cloudfoundry.org/cve-2018-1190/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.