CVE-2018-1195: Cloud Controller API will accept a refresh token for authentication
Cloud Foundry Foundation
Affected Cloud Foundry Products and Versions
- You are using Cloud Controller version prior to 1.46.0
- You are using cf-deployment version prior to 1.3.0
- You are using cf-release version prior to 283
Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.
Users of affected versions should apply the following mitigations or upgrades:
- Releases that have fixed this issue include:
- Cloud Controller 1.46.0
- cf-deployment 1.3.0
- cf-release 283
This issue was responsibly reported by SAP.
2018-03-05: Initial vulnerability report published.