CVE-2018-1266
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. An authenticated malicious user can predict the location of application blobs and leverage path traversal to create a malicious application that has the ability to overwrite arbitrary files on the Cloud Controller instance.
Cloud Foundry Cloud Controller, en versiones anteriores a la 1.52.0, contiene vulnerabilidades de revelación de información y salto de directorio. Un usuario malicioso autenticado puede predecir la localización de los BLOB de las aplicaciones y aprovechar el salto de directorio para crear una aplicación maliciosa que tenga la capacidad de sobrescribir archivos arbitrarios en la instancia Cloud Controller.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-12-06 CVE Reserved
- 2018-03-27 CVE Published
- 2024-03-05 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-330: Use of Insufficiently Random Values
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://www.cloudfoundry.org/blog/cve-2018-1266 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cloudfoundry Search vendor "Cloudfoundry" | Capi-release Search vendor "Cloudfoundry" for product "Capi-release" | < 1.52.0 Search vendor "Cloudfoundry" for product "Capi-release" and version " < 1.52.0" | - |
Affected
| ||||||