What’s Vulnerable › Vulnerabilities

CVE-2018-1195

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-19 · updated 2026-06-17
• Weakness: CWE-613

Description

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

Affected products

• Cloud Foundry CAPI: before 1.46.0 — fixed in 1.46.0
• Cloud Foundry cf-deployment: before 1.3.0 — fixed in 1.3.0
• Cloud Foundry Cloud Controller cf-release versions prior to v255: before 283 — fixed in 283

How to fix

Upgrade to a fixed version: Cloud Foundry CAPI 1.46.0; Cloud Foundry cf-deployment 1.3.0; Cloud Foundry Cloud Controller cf-release versions prior to v255 283. Check the vendor advisory for mitigations.

References

• https://www.cloudfoundry.org/blog/cve-2018-1195/
• https://www.cloudfoundry.org/blog/cve-2018-1195/

Get alerted when CVE-2018-1195 or the next vulnerability affects your stack