CVE-2017-8040

Published: Sep 9, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.

Affected (7)

Products: Vmware: Single Sign On For Pivotal Cloud Foundry

Vmware

1 product

Single Sign On For Pivotal Cloud Foundry

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.3.0
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.3.2
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.3.3
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.4.0
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.4.1
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.4.2
Vmware Single Sign On For Pivotal Cloud Foundry	Version 1.4.3