VulnerabilityModified
CVE-2018-1268
A remote authenticated malicious user knowing the GUID of an app may construct malicious requests to read from or write to the logs of that app.
MEDIUM 6.8EPSS 1.01%
Does this matter?
Lower severity and a low EPSS score (1.01%). Track it; it rarely justifies an emergency change on its own.
Description
Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests to read from or write to the logs of that app.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- cloudfoundry/loggregator
- Source
- security_alert@emc.com
References
- https://www.cloudfoundry.org/blog/cve-2018-1268Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2018-1268Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.