Design/Logic Flaw

2017-09-0901:29:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.9%

JSON

In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name.

CPENameOperatorVersion
single_sign-on_for_pivotal_cloud_foundryeq1.3.0
single_sign-on_for_pivotal_cloud_foundryeq1.3.2
single_sign-on_for_pivotal_cloud_foundryeq1.3.3
single_sign-on_for_pivotal_cloud_foundryeq1.4.1
single_sign-on_for_pivotal_cloud_foundryeq1.4.2
single_sign-on_for_pivotal_cloud_foundryeq1.4.0
single_sign-on_for_pivotal_cloud_foundryeq1.4.3

Name	Operator	Version
single_sign-on_for_pivotal_cloud_foundry	eq	1.3.0
single_sign-on_for_pivotal_cloud_foundry	eq	1.3.2
single_sign-on_for_pivotal_cloud_foundry	eq	1.3.3
single_sign-on_for_pivotal_cloud_foundry	eq	1.4.1
single_sign-on_for_pivotal_cloud_foundry	eq	1.4.2
single_sign-on_for_pivotal_cloud_foundry	eq	1.4.0
single_sign-on_for_pivotal_cloud_foundry	eq	1.4.3

References

www.securityfocus.com/bid/100615

pivotal.io/security/cve-2017-8041