Vulnerabilities for Cf-release (...) - CXSECURITY.COM

Vulnerabilities for 'Cf-release'

2018-01-04

CVE-2018-1190

CWE-79

An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.

2017-10-03

CVE-2017-8048

CWE-noinfo

In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.

CVE-2017-8047

In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.

>>> Vendor: Pivotal 22 Products

Operations manager

Spring framework

Cloud foundry elastic runtime

Spring security oauth

Routing-release

Spring web flow

Pcf tile generator

Elastic runtime

Cloud foundry php buildpack

Vmware harbor registry

Copyright 2024, cxsecurity.com