Cloud Foundry Cloud Controller Resource Management Error Vulnerability

The Cloud Foundry Cloud Controller is a component of the Cloud Foundry Foundation that is responsible for interacting with users in the Cloud Foundry architecture. This component manages the entire lifecycle of an app and allows users to interact with Cloud Server from the command line. A securit...

PT-2020-18456

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller CAPI versions prior to 1.91.0 Description The issue allows a malicious user with access to logs to potentially gain unauthorized access to resources protected by credentials, as sensitive information such as...

CVE-2020-5400: Insufficiently Protected Credentials

Cloud Foundry Cloud Controller CAPI, versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected b...

CVE-2019-11294: Exposure of Sensitive Information to an Unauthorized Actor

Cloud Foundry Cloud Controller API CAPI, version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins...

PT-2019-12234

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller API CAPI version 1.88.0 Description The issue allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins. Recommendations For...

PT-2019-16727

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller API Release versions prior to 1.79.0 Description The issue concerns improper authentication in the validation of user permissions. A remote authenticated malicious user, with the ability to create UAA clients and...

CVE-2019-3798: Improper Authentication

Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their...

CVE-2019-3785: Improper Authorization

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service...

PT-2019-16715

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller versions prior to 1.78.0 Description The issue concerns an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed...

PT-2018-4903

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 Cloud Foundry Cloud Controller, cf-release versions prior to v237 Description The issue is related to a business logic flaw. An application developer may create an applicatio...

CVE-2016-2169: Undefined Security Weakness

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service...

PT-2018-11315

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller versions prior to 1.52.0 Description The issue allows an authenticated malicious user to predict the location of application blobs and leverage path traversal to create a malicious application. This malicious...

CVE-2018-1266: Improper Limitation of a Pathname to a Restricted Directory

Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. An authenticated malicious user can predict the location of application blobs and leverage path traversal to create a malicious application that has the ability to overwri...