CVE-2017-8047 In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL....
MediumCVSS 6.1
EPSS 0.78%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-release | <= 273 | No fix listed |
| pivotal routing-release | <= 0.162.0 | No fix listed |
References
- www.cloudfoundry.org release-notes vendor-advisory