{"id":"CVE-2018-1192","details":"In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.","aliases":["GHSA-xg5v-696h-c3vr"],"modified":"2026-07-08T05:50:51.903800247Z","published":"2018-02-01T20:29:00.247Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"1.7"}],"source":"CPE_RANGE","vendor_product":"pivotal_software:cloud_foundry_cf-deployment","cpes":["cpe:2.3:a:pivotal_software:cloud_foundry_cf-deployment:*:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://www.cloudfoundry.org/blog/cve-2018-1192/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry-attic/cf-release","events":[{"introduced":"0"},{"fixed":"45d47f7ac8aced2f54e6fadf375ebc08f2e9d05f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"285"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:pivotal_software:cloud_foundry_cf-release:*:*:*:*:*:*:*:*"}}],"versions":["v284","v283","v278","v276","v275","v262","v260","v253","v249","v245","v205","v183","v170","v161","v157","v156","rc145.0","v143","works-for-us","v140","v137","v136","v135","v134","v133","v132","scotty_09012012","v119","v109","v105","v104","v103","v102","v100","v99","-","log","list"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1192.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa","events":[{"introduced":"df80f632e613efdf64a262dec4d015f1ccf9b8d6"},{"fixed":"830768517c01cb62bb6dd2c47220a718f7ff9fa3"},{"introduced":"754f2716d3d8f2e227952f74adcfde5378b17b96"},{"fixed":"6502d3b1a267fecc5392f93dfc2727d4451e930f"},{"introduced":"391163ebad397b8f3eb5298aa01412dd94c9a176"},{"fixed":"782856925a559640b8a442f261b614df4376b034"}],"database_specific":{"extracted_events":[{"introduced":"4.5.0"},{"fixed":"4.5.5"},{"introduced":"4.7.0"},{"fixed":"4.7.4"},{"introduced":"4.8.0"},{"fixed":"4.8.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*"}}],"versions":["4.8.2","4.8.1","4.7.3","4.5.3","4.8.0","4.7.1","4.7.0","4.5.2","4.5.1","4.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1192.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa-release","events":[{"introduced":"73a447e383811cdcab85c57c5f0480eb715ceb22"},{"last_affected":"bc6b5748b05e80dbd659b39e0b993be08c2231dc"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:45.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:52.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:53.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"45.7"},{"last_affected":"45.7"},{"introduced":"52.7"},{"last_affected":"52.7"},{"introduced":"53.3"},{"last_affected":"53.3"}]}}],"versions":["45.7","52.7","53.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1192.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}