CVE-2017-8033

High

Published: 25/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A filesystem traversal vulnerability was discovered in the Cloud Controller API in CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. It allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.

Risk Assessment

This vulnerability could lead to unauthorized access and privilege escalation, posing a serious threat to data security within the organization.

Recommendation

It is recommended to upgrade to CAPI-release v1.35.0 or cf-release v268 and conduct an audit of applications deployed in the Cloud Foundry environment.

Other vulnerabilities in Cloud Controller API

CVE-2017-8035High
An issue was discovered in the Cloud Foundry Foundation CAPI-release in versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.

Original NVD description (English source)

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.