CVE Feed

    Dashboard / CVE / CVE-2017-8033

    CVE-2017-8033

    An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.

    Published:Jul 25, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 25, 2017
    EPSS Score:0.00211
    CVSS Score:7.8

    Affected Products

    Vendor
    Cloudfoundry
    Product
    Capi-release
    Vendor
    Cloudfoundry
    Product
    Cf-release

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-20881 (CVSS 8.1) — Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may ove…
    CVE-2021-22100 (CVSS 5.3) — In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a serv…
    CVE-2021-22101 (CVSS 7.5) — Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerabil…
    CVE-2021-22115 (CVSS 6.5) — Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logg…
    CVE-2020-5423 (CVSS 7.5) — CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an una…
    CVE-2020-5418 (CVSS 4.3) — Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "clou…
    CVE-2020-5417 (CVSS 8.8) — Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain…
    CVE-2020-5400 (CVSS 6.5) — Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they …
    CVE-2019-11294 (CVSS 4.3) — Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service …
    CVE-2019-3798 (CVSS 6) — Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when va…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High