CVE-2017-14389

2017-11-2807:00:00

dell

www.cve.org

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an “Application Subdomain Takeover.”

CNA Affected

[
  {
    "product": "Cloud Foundry capi-release: All versions prior to 1.45.0, cf-release: All versions prior to v280, cf-deployment: All versions prior to v1.0.0",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cloud Foundry capi-release: All versions prior to 1.45.0, cf-release: All versions prior to v280, cf-deployment: All versions prior to v1.0.0"
      }
    ]
  }
]

References

www.cloudfoundry.org/cve-2017-14389/