CVE-2017-4991

CVE-2017-4991 affects Cloud Foundry products: cf-release versions before v260 and multiple UAA releases (2.x before v2.7.4.16; 3.6.x before v3.6.10; 3.9.x before v3.9.12; others before v3.17.0) plus UAA-bosh releases (uaa-release) before v13.14, v24.9, v30.2, and earlier versions before v36. The ...

CVE-2017-8048

In Cloud Foundry, CVE-2017-8048 is a regression introduced by the original fix for CVE-2017-8033. Affected are capi-release 1.33.0–1.41.x (prior to 1.42.0) and cf-release 268–273 (prior to 274). The issue enables a space developer to execute arbitrary code on the Cloud Controller VM by pushing a ...

CVE-2017-8033

The CVE-2017-8033 issue affects Cloud Foundry’s Cloud Controller API in capi-release v1.33.0+ and cf-release v268+ (pre-v1.35.0 and pre-v268 respectively), where a filesystem-traversal flaw lets a space developer write arbitrary files on the Cloud Controller VM by pushing a crafted app. The origi...

CVE-2016-0780

CVE-2016-0780 affects cf-release v231 and earlier and Pivotal Cloud Foundry Elastic Runtime: 1.5.x versions before 1.5.17 and 1.6.x versions before 1.6.18. The root cause is improper enforcement of disk quotas, allowing an attacker to use an incorrect quota value to bypass enforcement and exhaust...

CVE-2017-4972

CVE-2017-4972 describes a blind SQL injection vulnerability in Cloud Foundry components: cf-release before v257; UAA 2.x before v2.7.4.14, 3.6.x before v3.6.8, 3.9.x before v3.9.10, and other versions before v3.15.0; and UAA Release (uaa-release) 13.x before v13.12, 24.x before v24.7, and other v...

CVE-2017-8037

CVE-2017-8037 affects Cloud Foundry: CAPI-release v1.6.0+ up to < v1.38.0 and cf-release v244+ up to

CVE-2016-9882

CVE-2016-9882 affects Cloud Foundry cf-release before v250 and CAPI-release before v1.12.0. The issue is that Cloud Foundry logs credentials returned from service brokers in Cloud Controller system component logs; these logs are written to disk and often forwarded to log aggregators via syslog. T...

CVE-2017-8035

CVE-2017-8035 targets the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and before v1.35.0 (and cf-release after v244 and before v268). A carefully crafted CAPI request from a Space Developer can gain access to files on the Cloud Controller VM for that instal...