CVE-2017-8035

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud...

CVE-2017-8033

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a...

CVE-2017-8035

CVE-2017-8035 targets the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and before v1.35.0 (and cf-release after v244 and before v268). A carefully crafted CAPI request from a Space Developer can gain access to files on the Cloud Controller VM for that instal...

Pivotal Software Cloud Foundry cf-release and CAPI-release information disclosure vulnerabilities

Pivotal Software Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other capabilities. cf-release and...

CVE-2017-8035: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud...

PT-2017-18080

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 Cloud Foundry Foundation cf-release versions after v244 and prior to v268 Description An issue in the Cloud Controller API allows a Space Developer to gain access...

Pivotal Software Cloud Foundry cf-release and CAPI-release path traversal vulnerabilities

Pivotal Software Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other capabilities. cf-release and...

CVE-2017-8036

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

Design/Logic Flaw

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

CVE-2017-8036

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

CVE-2017-8036

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

CVE-2017-8036: Undefined Security Weakness

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

PT-2017-18081

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation CAPI-release version 1.33.0 Description An issue in the Cloud Controller API allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. This issue is a...

Multiple Pivotal Software Products Accept Expired Certificates Vulnerability

Pivotal Cloud Foundry PCF, UAA, and UAA-Release are products of Pivotal Software, Inc. of the U.S. PCF is a suite of open-source Platform-as-a-Service PaaS cloud computing platforms that provide features such as container scheduling, continuous delivery, and automated service deployment; UAA is a...

Multiple Node.js Vulnerabilities | Cloud Foundry

Severity High Vendor Node.js Versions Affected Node.js: 4.x versions prior to 4.8.4 6.x versions prior to 6.11.1 7.x versions prior to 7.10.1 8.x versions prior to 8.1.4 Description All current versions of v4.x through to v8.x inclusive are vulnerable to an issue that can be used by an external...

Elevation of Privilege Vulnerability in Multiple Pivotal Products

Pivotal Software Cloud Foundry CF is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software, Inc. that provides container scheduling, continuous delivery, and automated service deployment, among other features.CF-release is a release of CF.CAPI-release capi and...

CVE-2017-8036: Cloud Controller API regression | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Versions Affected CAPI-release version 1.33.0 only Description The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing...

CVE-2017-8035: Cloud Controller API access to CC VM contents | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Versions Affected CAPI-release versions after v1.6.0 and prior to v1.35.0 cf-release versions after v244 and prior to v268 Description A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud...

CVE-2017-8033: Cloud Controller API filesystem traversal vulnerability | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected CAPI-release versions prior to v1.35.0 cf-release versions prior to v268 Description A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a...

CVE-2017-8034

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...