CVE Feed

    Dashboard / CVE / CVE-2017-8034

    CVE-2017-8034

    The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.

    Published:Jul 17, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 17, 2017
    EPSS Score:0.00472
    CVSS Score:6.6

    Affected Products

    Vendor
    Cloudfoundry
    Product
    Capi-release
    Vendor
    Cloudfoundry
    Product
    Cf-release
    Vendor
    Cloudfoundry
    Product
    Routing-release

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-20881 (CVSS 8.1) — Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may ove…
    CVE-2021-22100 (CVSS 5.3) — In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a serv…
    CVE-2021-22101 (CVSS 7.5) — Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerabil…
    CVE-2021-22115 (CVSS 6.5) — Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logg…
    CVE-2020-5423 (CVSS 7.5) — CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an una…
    CVE-2020-5418 (CVSS 4.3) — Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "clou…
    CVE-2020-5417 (CVSS 8.8) — Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain…
    CVE-2020-5400 (CVSS 6.5) — Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they …
    CVE-2019-11294 (CVSS 4.3) — Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service …
    CVE-2019-3798 (CVSS 6) — Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when va…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High