CVE-2018-1192: Cloud Foundry UAA SessionID present in Audit Event Logs
Summary
CVE-2018-1192: Cloud Foundry UAA SessionID present in Audit Event Logs. Affects org.cloudfoundry.identity:cloudfoundry-identity-server across 3 version ranges.
< 4.5.5
>= 4.6.0, < 4.7.4
>= 4.8.0, < 4.8.3
Fixed in 4.5.5, 4.7.4 or 4.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud Foundry UAA (User Account and Authentication) is an open-source identity management service used in Cloud Foundry deployments. It provides authentication and authorization for users and applications. The UAA session ID is a unique identifier assigned to each user session. Audit event logs record important security-related activities in the system. However, in vulnerable versions of Cloud Foundry UAA, the session ID is logged in the audit event logs, which can be exploited by attackers to impersonate logged-in users.
Vulnerability Detail
The vulnerability exists in Cloud Foundry Foundation cf-release versions prior to v285, cf-deployment versions prior to v1.7, UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4, as well as UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3. The presence of the session ID in audit event logs allows attackers to obtain the session ID and impersonate a logged-in user. This can lead to unauthorized access, data breaches, and other malicious activities.
How To Fix
Latest published version: 4.30.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.5.54.5.5 -
>= 4.6.0, < 4.7.44.7.4 -
>= 4.8.0, < 4.8.34.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Cloud Foundry UAA allows attackers to obtain session IDs from audit event logs and impersonate logged-in users. To mitigate this risk, it is crucial to upgrade to the fixed versions of Cloud Foundry UAA. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.cloudfoundry.identity:cloudfoundry-identity-server →
FAQ
Cloud Foundry UAA is an open-source identity management service used in Cloud Foundry deployments. It provides authentication and authorization for users and applications.
A session ID is a unique identifier assigned to each user session. It is used to maintain the user's state and authenticate subsequent requests.
The vulnerability allows attackers to obtain the session ID from audit event logs and impersonate logged-in users. This can lead to unauthorized access, data breaches, and other malicious activities.
The vulnerability affects Cloud Foundry Foundation cf-release versions prior to v285, cf-deployment versions prior to v1.7, UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4, as well as UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3.
To fix the vulnerability, it is recommended to upgrade to the fixed versions of Cloud Foundry UAA as mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.cloudfoundry.identity:cloudfoundry-identity-server.
