Detections
Analytics
SCA: security update for org.cloudfoundry.identity:cloudfoundry-identity-server (GHSA-j97q-9xp9-g5fx)
medium Tenable Cloud Security Plugin ID 433987
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270,
UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to
v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA
OpenID Connect check session iframe endpoint used for single logout session management. (CVE-2018-1190)
See Also
Plugin Details
Severity: Medium
ID: 433987
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 8.67
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2018-1190
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/13/2022
Vulnerability Publication Date: 1/4/2018
Reference Information
CVE: CVE-2018-1190
BID: 102427
cwe: CWE-79