High
Cloud Foundry Foundation
Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.
Users of affected versions should apply the following mitigations or upgrades:
This issue was responsibly reported by SAP**.**
2018-03-05: Initial vulnerability report published.