CVE-2018-1191 Information disclosure in Garden-runC
Attackers with log access can obtain leaked credentials to perform authenticated actions in Cloud Foundry Garden-runC.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1191?
CVE-2018-1191 is a high-severity vulnerability in Cloud Foundry Garden-runC, published on 29 Mar 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials.
Which versions are affected by CVE-2018-1191?
It affects 2 products.
Products include Cloudfoundry Cf-Deployment, Cloudfoundry Garden-Runc-Release.
How do I fix CVE-2018-1191?
No fix has been published for CVE-2018-1191 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-1191 being exploited?
There is no known exploitation of CVE-2018-1191 in the wild and no public exploit code.
Other vulnerabilities in Cloud Foundry Garden-runC
- CVE-2022-31733 Auth bypass in Cloud Foundry Diego and CF Deployment
- CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs
- CVE-2019-11293 UAA logs all query parameters with debug logging level
- CVE-2019-11290 Cloud Foundry UAA logs query parameters in tomcat access file
- CVE-2019-11283 Password leak in smbdriver logs
Sources
Also known as GHSA-gmr3-mrrf-r3v7.