The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://www.cloudfoundry.org/cve-2017-8034/ |
History
No history.
MITRE
Status: PUBLISHED
Assigner: dell
Published: 2017-07-17T14:00:00
Updated: 2024-08-05T16:19:29.540Z
Reserved: 2017-04-21T00:00:00
Link: CVE-2017-8034
Vulnrichment
No data.
NVD
Status : Modified
Published: 2017-07-17T14:29:01.280
Modified: 2024-11-21T03:33:11.503
Link: CVE-2017-8034
Redhat
No data.