CVE-2018-11083

CVE-2018-11083 affects Cloud Foundry BOSH prior to 264.14.0, 265.7.0, 266.8.0, and 267.2.0. The root cause is that BOSH accepts admin refresh tokens issued by UAA as if they were access tokens, allowing a remote attacker with such a token to access BOSH resources even after the attacker’s user sh...

CVE-2018-11083 Bosh accepts refresh tokens in place of an access token

Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access...