CVE-2018-15796

HIGH

Cloud Foundry Bits Service < 2.14.0 - Insecure URL Signing Key Exposure

Title source: llm
STIX 2.1

Description

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.cloudfoundry.org/blog/cve-2018-15796

Scores

CVSS v3 8.1
EPSS 0.0071
EPSS Percentile 48.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-326
Status published
Products (1)
pivotal_software/bits_service < 2.14.0
Published Nov 09, 2018
Tracked Since Feb 18, 2026