Vulnerability Description
Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Cloud Foundry Log Cache | < 1.1.1 |
Related Weaknesses (CWE)
References
- https://www.cloudfoundry.org/blog/cve-2018-1264/Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2018-1264/Vendor Advisory
FAQ
What is CVE-2018-1264?
CVE-2018-1264 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secre...
How severe is CVE-2018-1264?
CVE-2018-1264 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-1264?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Cloud Foundry Log Cache.