Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-8218

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.

Published

2017-06-13T06:29:00.237

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cloudfoundry cf-release ≤ 203 Yes
Application cloudfoundry cf-release 204 Yes
Application cloudfoundry cf-release 205 Yes
Application cloudfoundry cf-release 206 Yes
Application cloudfoundry cf-release 207 Yes
Application cloudfoundry cf-release 208 Yes
Application cloudfoundry cf-release 209 Yes
Application cloudfoundry cf-release 210 Yes
Application cloudfoundry cf-release 211 Yes
Application cloudfoundry cf-release 212 Yes
Application cloudfoundry cf-release 213 Yes
Application cloudfoundry cf-release 214 Yes
Application cloudfoundry cf-release 215 Yes
Application cloudfoundry cf-release 217 Yes
Application cloudfoundry cf-release 218 Yes
Application cloudfoundry cf-release 219 Yes
Application cloudfoundry cf-release 220 Yes
Application cloudfoundry cf-release 221 Yes
Application cloudfoundry cf-release 222 Yes
Application cloudfoundry cf-release 223 Yes
Application cloudfoundry cf-release 224 Yes
Application cloudfoundry cf-release 225 Yes
Application cloudfoundry cf-release 226 Yes
Application cloudfoundry cf-release 227 Yes
Application cloudfoundry cf-release 228 Yes
Application cloudfoundry cf-release 229 Yes
Application cloudfoundry cf-release 230 Yes
Application cloudfoundry cf-release 231 Yes
Application cloudfoundry routing-release ≤ 0.141.0 Yes
References