CVE:CVE-2018-1192
CNNVD:CNNVD-201802-004
Pivotal Cloud Foundry cf-release等都是美国Pivotal Software公司的产品。Pivotal Cloud Foundry cf-release是一套开源的平台即服务（PaaS）云计算平台，它提供容器调度、持续交付和自动化服务部署等功能。UAA是PCF的一个身份验证和管理服务终端，UAA bosh releas是它的发布版本。
多款Pivotal产品中存在安全漏洞，该漏洞源于程序将SessionID记录到审核事件日志中。攻击者可通过使用SessionID利用该漏洞冒充登录的用户。以下产品和版本受到影响：Cloud Foundry cf-release 285之前版本；cf-deployment 1.7之前版本；UAA 4.5.5之前的4.5.x版本，4.8.3之前的4.8.x版本，4.7.4之前的4.7.x版本；UAA-release 45.7之前的45.7.x版本，52.7之前的52.7.x版本，53.3之前的53.3.x版本。
solution:Upgrade pivotal_software cloud_foundry_uaa to a higher version than 4.5.5,4.7.4,4.8.3,and avoid the version [4.5.0,4.5.5),[4.7.0,4.7.4),[4.8.0,4.8.3); Upgrade pivotal_software cloud_foundry_uaa-release to a higher version than 45.7,52.7,53.3,and avoid the version 45.7,52.7,53.3; Upgrade pivotal_software cloud_foundry_cf-release to a higher version than 285,and avoid the version (,285); Upgrade pivotal_software cloud_foundry_cf-deployment to a higher version than 1.7,and avoid the version (,1.7)