{"containers": {"cna": {"affected": [{"product": "Windows Stemcells", "vendor": "Dell EMC", "versions": [{"status": "affected", "version": "All versions prior to 1200.14"}]}], "datePublic": "2018-02-22T00:00:00", "descriptions": [{"lang": "en", "value": "In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials."}], "problemTypes": [{"descriptions": [{"description": "GCP Metadata Endpoint Accessible from Application Containers on Windows", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-03-19T17:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cloudfoundry.org/blog/cve-2018-1197/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2018-02-22T00:00:00", "ID": "CVE-2018-1197", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Windows Stemcells", "version": {"version_data": [{"version_value": "All versions prior to 1200.14"}]}}]}, "vendor_name": "Dell EMC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "GCP Metadata Endpoint Accessible from Application Containers on Windows"}]}]}, "references": {"reference_data": [{"name": "https://www.cloudfoundry.org/blog/cve-2018-1197/", "refsource": "CONFIRM", "url": "https://www.cloudfoundry.org/blog/cve-2018-1197/"}]}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2018-1197", "datePublished": "2018-02-22T00:00:00", "dateReserved": "2017-12-06T00:00:00", "dateUpdated": "2018-03-19T17:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pivotal_software:windows_stemcells:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE196C1-7A52-4520-86AB-835134524405", "versionEndExcluding": "1200.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials."}, {"lang": "es", "value": "En las versiones anteriores a la 1200.14 de Windows Stemcells, las aplicaciones que se ejecutan en contenedores en Windows en Google Cloud Platform pueden acceder al endpoint de metadatos. Un usuario malicioso podr\u00eda emplear esto para obtener credenciales privilegiados."}], "id": "CVE-2018-1197", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-19T18:29:00.437", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.cloudfoundry.org/blog/cve-2018-1197/"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}