Vulnerability Details CVE-2018-1264
Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.1%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 5.0
References
Products affected by CVE-2018-1264
-
cpe:2.3:a:pivotal_software:cloud_foundry_log_cache:0.1
-
cpe:2.3:a:pivotal_software:cloud_foundry_log_cache:1.0.0