CVE-2018-1190
Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
- Record
CVE-2018-1190- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
- Record
CVE-2018-1190- Updated
- 2026-11-02
EUVDEUVD-2022-4320 No score
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
- Record
EUVD-2022-4320- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j97q-9xp9-g5fx
Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
- Record
GHSA-j97q-9xp9-g5fx- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
- Record
CVE-2018-1190- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-j97q-9xp9-g5fx
Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
- Record
GHSA-j97q-9xp9-g5fx- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.cloudfoundry.identity:cloudfoundry-identity-serverMaven |
3.0.0 up to 3.20.2 | 3.20.2 |
org.cloudfoundry.identity:cloudfoundry-identity-serverMaven |
3.0.0 up to 3.20.2, plus listed versions 3.0.13.1.03.10.03.12.03.13.0 Show 25 moreShow less3.15.03.16.03.18.03.19.03.2.03.2.13.20.03.3.03.3.0.13.3.0.23.3.0.33.3.0.43.3.0.53.4.03.4.23.4.33.4.43.4.53.5.03.6.03.7.03.7.33.8.03.9.03.9.1 |
3.20.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1190 is a medium vulnerability (CVSS 6.1) in Cloudfoundry Cf-release, published January 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in org.cloudfoundry.identity:cloudfoundry-identity-server 3.20.2.
References
securityfocus.com/bid/102427
cloudfoundry.org/cve-2018-1190
nvd.nist.gov/vuln/detail/CVE-2018-1190
github.com/cloudfoundry/uaa/commit/96fe26711f8f8855d2994a531447f730afd61844
web.archive.org/web/20200227133214/http://www.securityfocus.com/bid/102427