CVE-2017-8035

High

Published: 25/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in the Cloud Foundry Foundation CAPI-release in versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.

Risk Assessment

Access to files on the Cloud Controller VM may lead to the exposure of sensitive data, posing a serious security threat to the organization.

Recommendation

It is recommended to upgrade to the latest version of CAPI-release and cf-release to mitigate this vulnerability.

Other vulnerabilities in Cloud Controller API

CVE-2017-8033High
A filesystem traversal vulnerability was discovered in the Cloud Controller API in CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. It allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.

Original NVD description (English source)

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.