Read the docs
TI-2018-01173 Aliases CVE-2018-1268GHSA-3gw8-xrcq-5xfv

Improper input validation in Cloud Foundry Loggregator

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests to read from or write to the logs of that app.

Why it matters now

EPSS 0.01015 63rd percentileScored 2026-11-07
Fix Fixed Loggregator (Cloud Foundry): 89.5, 96.1, 99.1 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloud FoundryLoggregator89.x to before 89.5; 96.x to before 96.1; 99.x to before 99.1; 101.x to before 101.9; 102.x to before 102.289.5, 96.1, 99.1, 101.9, 102.2Patch availableCNA
  • Loggregator VendorCloud Foundry Affected 89.x to before 89.5; 96.x to before 96.1; 99.x to before 99.1; 101.x to before 101.9; 102.x to before 102.2 Fixed in 89.5, 96.1, 99.1, 101.9, 102.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:loggregator:*:*:*:*:*:*:*:*89 to before 89.5; 96 to before 96.1; 99 to before 99.1; 101 to before 101.9; 102 to before 102.2VulnerableCloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:loggregator:*:*:*:*:*:*:*:* Versions 89 to before 89.5; 96 to before 96.1; 99 to before 99.1; 101 to before 101.9; 102 to before 102.2 Vulnerable ·CloudFoundry Foundation

Remediation

  • Fix · CNA Loggregator (Cloud Foundry) Fixed in 89.5, 96.1, 99.1, 101.9, 102.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cloud Foundry Loggregator 101.9, 102.2 and 3 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2018-01174 Improper handling of exceptional conditions in Cloud Foundry LoggregatorPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1268
  2. 2026-10-03 Alias added: GHSA-3gw8-xrcq-5xfv

References

Advisory 1

  • TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
  • TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
  • TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
  • TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
  • TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
  • TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences