{"id":"CVE-2018-1262","details":"Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.","aliases":["GHSA-8v97-gv3g-32rf"],"modified":"2026-07-08T05:54:19.881280843Z","published":"2018-05-15T20:29:00.400Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"4.12.0"},{"last_affected":"4.12.0"},{"introduced":"4.12.0"},{"last_affected":"4.12.0"}],"source":"CPE_STRING","vendor_product":"pivotal_software:cloud_foundry_uaa","cpes":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.12.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://www.cloudfoundry.org/blog/cve-2018-1262/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/cf-deployment","events":[{"introduced":"68e73dcf9741f8a7bf6f83e432257abc025c19b6"},{"last_affected":"1bf516e1fffd86002d92d1d8c016d541c9d7a95b"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.27.0"},{"last_affected":"1.31.0"}]}}],"versions":["v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1262.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa","events":[{"introduced":"18e9629e64e4ece65e5325283181444f02743bb3"},{"last_affected":"8f58f9a92543ba316b432947b003dc56852ba908"}],"database_specific":{"cpe":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.12.0:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.12.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.12.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.13.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.13.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.13.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:4.13.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.12.0"},{"last_affected":"4.12.0"},{"introduced":"4.12.1"},{"last_affected":"4.12.1"},{"introduced":"4.12.2"},{"last_affected":"4.12.2"},{"introduced":"4.13.0"},{"last_affected":"4.13.0"},{"introduced":"4.13.1"},{"last_affected":"4.13.1"},{"introduced":"4.13.2"},{"last_affected":"4.13.2"},{"introduced":"4.13.3"},{"last_affected":"4.13.3"},{"introduced":"4.13.4"},{"last_affected":"4.13.4"}],"source":"CPE_STRING"}}],"versions":["4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.13.3","4.13.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1262.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa-release","events":[{"introduced":"2b0f68c74879c286ee85d574c0a65c11a0737036"},{"last_affected":"c3e1799168522ce42925bb8831ec528c67181e92"}],"database_specific":{"extracted_events":[{"introduced":"57"},{"last_affected":"57"},{"introduced":"57.1"},{"last_affected":"57.1"},{"introduced":"58"},{"last_affected":"58"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:57:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:57.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:58:*:*:*:*:*:*:*"]}}],"versions":["57","57.1","58","v58","v57"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1262.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}