CVE-2017-8037

Published: Aug 21, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.

Affected (56)

Products: Cloudfoundry: Capi Release, Cf Release

Cloudfoundry

2 products

Capi Release

Cf Release

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Capi Release	Version 1.10.0
Cloudfoundry Capi Release	Version 1.11.0
Cloudfoundry Capi Release	Version 1.12.0
Cloudfoundry Capi Release	Version 1.13.0
Cloudfoundry Capi Release	Version 1.14.0
Cloudfoundry Capi Release	Version 1.15.0
Cloudfoundry Capi Release	Version 1.16.0
Cloudfoundry Capi Release	Version 1.17.0
Cloudfoundry Capi Release	Version 1.18.0
Cloudfoundry Capi Release	Version 1.19.0
Cloudfoundry Capi Release	Version 1.20.0
Cloudfoundry Capi Release	Version 1.21.0
Cloudfoundry Capi Release	Version 1.22.0
Cloudfoundry Capi Release	Version 1.23.0
Cloudfoundry Capi Release	Version 1.24.0
Cloudfoundry Capi Release	Version 1.25.0
Cloudfoundry Capi Release	Version 1.26.0
Cloudfoundry Capi Release	Version 1.27.0
Cloudfoundry Capi Release	Version 1.28.0
Cloudfoundry Capi Release	Version 1.29.0
Cloudfoundry Capi Release	Version 1.30.0
Cloudfoundry Capi Release	Version 1.31.0
Cloudfoundry Capi Release	Version 1.32.0
Cloudfoundry Capi Release	Version 1.33.0
Cloudfoundry Capi Release	Version 1.34.0
Cloudfoundry Capi Release	Version 1.35.0
Cloudfoundry Capi Release	Version 1.36.0
Cloudfoundry Capi Release	Version 1.37.0
Cloudfoundry Capi Release	Version 1.7.0
Cloudfoundry Capi Release	Version 1.8.0
Cloudfoundry Capi Release	Version 1.9.0

Configuration B

25 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Cf Release	Version 245
Cloudfoundry Cf Release	Version 246
Cloudfoundry Cf Release	Version 247
Cloudfoundry Cf Release	Version 248
Cloudfoundry Cf Release	Version 249
Cloudfoundry Cf Release	Version 250
Cloudfoundry Cf Release	Version 251
Cloudfoundry Cf Release	Version 252
Cloudfoundry Cf Release	Version 253
Cloudfoundry Cf Release	Version 254
Cloudfoundry Cf Release	Version 255
Cloudfoundry Cf Release	Version 256
Cloudfoundry Cf Release	Version 257
Cloudfoundry Cf Release	Version 258
Cloudfoundry Cf Release	Version 259
Cloudfoundry Cf Release	Version 260
Cloudfoundry Cf Release	Version 261
Cloudfoundry Cf Release	Version 262
Cloudfoundry Cf Release	Version 263
Cloudfoundry Cf Release	Version 264
Cloudfoundry Cf Release	Version 265
Cloudfoundry Cf Release	Version 266
Cloudfoundry Cf Release	Version 267
Cloudfoundry Cf Release	Version 268
Cloudfoundry Cf Release	Version 269

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://www.securityfocus.com/bid/100448

Source: security_alert@emc.com

https://www.cloudfoundry.org/cve-2017-8037/

Source: security_alert@emc.com

Vendor Advisory

http://www.securityfocus.com/bid/100448

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.cloudfoundry.org/cve-2017-8037/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.