CVE-2018-11083

CVE-2018-11083 affects Cloud Foundry BOSH prior to 264.14.0, 265.7.0, 266.8.0, and 267.2.0. The root cause is that BOSH accepts admin refresh tokens issued by UAA as if they were access tokens, allowing a remote attacker with such a token to access BOSH resources even after the attacker’s user sh...