CVE-2017-8034 The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer...
MediumCVSS 6.6
EPSS 0.75%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry capi-release | <= 1.31.0 | No fix listed |
| cloudfoundry cf-release | <= 266 | No fix listed |
| cloudfoundry routing-release | <= 0.158.0 | No fix listed |
References
- www.cloudfoundry.org vendor-advisory