CVE-2017-4992

CVE-2017-4992 affects Cloud Foundry components including cf-release prior to v261 and UAA releases prior to specified versions (2.x before 2.7.4.17, 3.6.x before 3.6.11, 3.9.x before 3.9.13, and other versions before v4.2.0; UAA bosh releases prior to 13.x before 13.15, 24.x before 24.10, 30.x be...

CVE-2015-5171

Ø CVE-2015-5171 affects Cloud Foundry components (cf-release <216, UAA <2.5.2, PCF Elastic Runtime

CVE-2015-5172

CVE-2015-5172 affects Cloud Foundry Runtime: cf-release prior to 216, UAA prior to 2.5.2, and PCF Elastic Runtime prior to 1.7.0, due to failure to expire password reset links. Connected sources (GHSA/osv entries) corroborate the affected components and the weak password recovery mechanism, descr...

CVE-2016-6658

CVE-2016-6658 affects cf-release before 245. It allows configuring and pushing with a user-provided buildpack URL that may include credentials (basic auth or OAuth) to access a private buildpack. The buildpack URL is stored unencrypted, so an operator with privileged Cloud Controller DB access co...

CVE-2016-8218

CVE-2016-8218 affects Cloud Foundry’s routing-release (versions prior to 0.142.0) and cf-release (203–231). The issue is incomplete validation in JSON Web Token (JWT) libraries, enabling unprivileged attackers to impersonate other users to the routing API. Remediation: upgrade routing-release to ...

CVE-2016-6655

CVE-2016-6655 affects Cloud Foundry Foundation Cloud Foundry releases prior to v245 and cf-mysql-release prior to v31. A command injection vulnerability exists in a common script used by many Cloud Foundry components, enabling a malicious user to execute arbitrary commands on affected servers. Th...