High severity · published Oct 5, 2018
CVE-2018-11083
Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens…
8.1
CVSS
1.5%
EPSS
No
On KEV
Description
Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resources.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bosh · Cloud Foundry
264.1 before 264.14.0; 265.1.0 before 265.7.0; 266.2.0 before 266.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11083
Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2018-11083
More from Bosh
8.8
CVE-2017-4961
An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions
7.8
CVE-2019-11271
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database
5.8
CVE-2026-41009
Local Blobstore may allow arbitrary reads/deletes
5.0
CVE-2026-41704
Compromised VM can make arbitrary blobstore deletes