PT-2017-18079
CVE-2017-8034
·
تاريخ النشر
2017-07-17
·
تاريخ التحديث
2019-10-03
الوصف من
CVSS 3.1
6.6
متوسطةالمقاييسAV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Cloud Foundry CAPI-release versions prior to v1.32.0
Cloud Foundry Routing-release versions prior to v0.159.0
Cloud Foundry CF-release versions prior to v267
Description
The issue concerns the Cloud Controller and Router in Cloud Foundry, which fail to validate the issuer on JSON Web Tokens (JWTs) from UAA. This can lead to privilege escalation by zone administrators in certain multi-zone UAA configurations.
Recommendations
For Cloud Foundry CAPI-release versions prior to v1.32.0, update to version v1.32.0 or later.
For Cloud Foundry Routing-release versions prior to v0.159.0, update to version v0.159.0 or later.
For Cloud Foundry CF-release versions prior to v267, update to version v267 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾