CVE-2018-1190 — Cross-site Scripting in Cf-release

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 55.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cloudfoundry Cf-releasePivotal UAAPivotal UAA Bosh
Timeline
PublishedJan 4
Latest updateMay 13

Description

An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDpivotal/uaa3.0.0 — 3.20.1

🔴Vulnerability Details

3
GHSA
Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint↗2022-05-13
▶
OSV
Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint↗2022-05-13
▶
CVEList
CVE-2018-1190: An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3↗2018-01-04
▶

💥Exploits & PoCs

1
Exploit-DB
RhinOS CMS 3.x - Arbitrary File Download↗2018-10-29
▶

💬Community

1
Bugzilla
CVE-2018-14437 ImageMagick: memory leak in parse8BIM in coders/meta.c↗2018-07-30
▶
CVE-2018-1190 — Cross-site Scripting in Cf-release | cvebase