9.8

CVE-2016-8218

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cloudfoundry ≫ Cf-release Version <= 203
Cloudfoundry ≫ Cf-release Version 204
Cloudfoundry ≫ Cf-release Version 205
Cloudfoundry ≫ Cf-release Version 206
Cloudfoundry ≫ Cf-release Version 207
Cloudfoundry ≫ Cf-release Version 208
Cloudfoundry ≫ Cf-release Version 209
Cloudfoundry ≫ Cf-release Version 210
Cloudfoundry ≫ Cf-release Version 211
Cloudfoundry ≫ Cf-release Version 212
Cloudfoundry ≫ Cf-release Version 213
Cloudfoundry ≫ Cf-release Version 214
Cloudfoundry ≫ Cf-release Version 215
Cloudfoundry ≫ Cf-release Version 217
Cloudfoundry ≫ Cf-release Version 218
Cloudfoundry ≫ Cf-release Version 219
Cloudfoundry ≫ Cf-release Version 220
Cloudfoundry ≫ Cf-release Version 221
Cloudfoundry ≫ Cf-release Version 222
Cloudfoundry ≫ Cf-release Version 223
Cloudfoundry ≫ Cf-release Version 224
Cloudfoundry ≫ Cf-release Version 225
Cloudfoundry ≫ Cf-release Version 226
Cloudfoundry ≫ Cf-release Version 227
Cloudfoundry ≫ Cf-release Version 228
Cloudfoundry ≫ Cf-release Version 229
Cloudfoundry ≫ Cf-release Version 230
Cloudfoundry ≫ Cf-release Version 231
Cloudfoundry ≫ Routing-release Version <= 0.141.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.3% 0.666
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://www.cloudfoundry.org/cve-2016-8218/
Patch
Vendor Advisory