CVE-2018-1265

2018-06-0500:00:00

dell

www.cve.org

7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

JSON

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell.

CNA Affected

[
  {
    "product": "Diego",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "lessThan": "2.8.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cloudfoundry.org/blog/cve-2018-1265/