Lucene search

[email protected]CVE-2016-8218

HistoryJun 13, 2017 - 6:29 a.m.

CVE-2016-8218

2017-06-1306:29:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2016-8218

cloud foundry foundation

routing-release

cf-release

json web token

jwt

security vulnerability

nvd

cve

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an “Unauthenticated JWT signing algorithm in routing” issue.

Affected configurations

NVD

Node

cloudfoundrycf-releaseRange≤203

cloudfoundrycf-releaseMatch204

cloudfoundrycf-releaseMatch205

cloudfoundrycf-releaseMatch206

cloudfoundrycf-releaseMatch207

cloudfoundrycf-releaseMatch208

cloudfoundrycf-releaseMatch209

cloudfoundrycf-releaseMatch210

cloudfoundrycf-releaseMatch211

cloudfoundrycf-releaseMatch212

cloudfoundrycf-releaseMatch213

cloudfoundrycf-releaseMatch214

cloudfoundrycf-releaseMatch215

cloudfoundrycf-releaseMatch217

cloudfoundrycf-releaseMatch218

cloudfoundrycf-releaseMatch219

cloudfoundrycf-releaseMatch220

cloudfoundrycf-releaseMatch221

cloudfoundrycf-releaseMatch222

cloudfoundrycf-releaseMatch223

cloudfoundrycf-releaseMatch224

cloudfoundrycf-releaseMatch225

cloudfoundrycf-releaseMatch226

cloudfoundrycf-releaseMatch227

cloudfoundrycf-releaseMatch228

cloudfoundrycf-releaseMatch229

cloudfoundrycf-releaseMatch230

cloudfoundrycf-releaseMatch231

cloudfoundryrouting-releaseRange≤0.141.0

CPENameOperatorVersion
cloudfoundry:cf-releasecloudfoundry cf-releasele203
cloudfoundry:cf-releasecloudfoundry cf-releaseeq204
cloudfoundry:cf-releasecloudfoundry cf-releaseeq205
cloudfoundry:cf-releasecloudfoundry cf-releaseeq206
cloudfoundry:cf-releasecloudfoundry cf-releaseeq207
cloudfoundry:cf-releasecloudfoundry cf-releaseeq208
cloudfoundry:cf-releasecloudfoundry cf-releaseeq209
cloudfoundry:cf-releasecloudfoundry cf-releaseeq210
cloudfoundry:cf-releasecloudfoundry cf-releaseeq211
cloudfoundry:cf-releasecloudfoundry cf-releaseeq212

CPE	Name	Operator	Version
cloudfoundry:cf-release	cloudfoundry cf-release	le	203
cloudfoundry:cf-release	cloudfoundry cf-release	eq	204
cloudfoundry:cf-release	cloudfoundry cf-release	eq	205
cloudfoundry:cf-release	cloudfoundry cf-release	eq	206
cloudfoundry:cf-release	cloudfoundry cf-release	eq	207
cloudfoundry:cf-release	cloudfoundry cf-release	eq	208
cloudfoundry:cf-release	cloudfoundry cf-release	eq	209
cloudfoundry:cf-release	cloudfoundry cf-release	eq	210
cloudfoundry:cf-release	cloudfoundry cf-release	eq	211
cloudfoundry:cf-release	cloudfoundry cf-release	eq	212

Rows per page:

1-10 of 291

CNA Affected

[
  {
    "product": "Cloud Foundry",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cloud Foundry"
      }
    ]
  }
]

References

www.cloudfoundry.org/cve-2016-8218/

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

Related for CVE-2016-8218

osv1 nvd1 cloudfoundry1 prion1 cvelist1