Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-8048

In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.

Published

2017-10-04T01:29:03.653

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cloudfoundry cf-release 268 Yes
Application cloudfoundry cf-release 269 Yes
Application cloudfoundry cf-release 270 Yes
Application cloudfoundry cf-release 271 Yes
Application cloudfoundry cf-release 272 Yes
Application cloudfoundry cf-release 273 Yes
Application pivotal capi-release 1.33.0 Yes
Application pivotal capi-release 1.34.0 Yes
Application pivotal capi-release 1.35.0 Yes
Application pivotal capi-release 1.36.0 Yes
Application pivotal capi-release 1.37.0 Yes
Application pivotal capi-release 1.38.0 Yes
Application pivotal capi-release 1.39.0 Yes
Application pivotal capi-release 1.40.0 Yes
Application pivotal capi-release 1.41.0 Yes
References