7.5

CVE-2017-8037

In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cloudfoundry ≫ Capi-release Version 1.7.0
Cloudfoundry ≫ Capi-release Version 1.8.0
Cloudfoundry ≫ Capi-release Version 1.9.0
Cloudfoundry ≫ Capi-release Version 1.10.0
Cloudfoundry ≫ Capi-release Version 1.11.0
Cloudfoundry ≫ Capi-release Version 1.12.0
Cloudfoundry ≫ Capi-release Version 1.13.0
Cloudfoundry ≫ Capi-release Version 1.14.0
Cloudfoundry ≫ Capi-release Version 1.15.0
Cloudfoundry ≫ Capi-release Version 1.16.0
Cloudfoundry ≫ Capi-release Version 1.17.0
Cloudfoundry ≫ Capi-release Version 1.18.0
Cloudfoundry ≫ Capi-release Version 1.19.0
Cloudfoundry ≫ Capi-release Version 1.20.0
Cloudfoundry ≫ Capi-release Version 1.21.0
Cloudfoundry ≫ Capi-release Version 1.22.0
Cloudfoundry ≫ Capi-release Version 1.23.0
Cloudfoundry ≫ Capi-release Version 1.24.0
Cloudfoundry ≫ Capi-release Version 1.25.0
Cloudfoundry ≫ Capi-release Version 1.26.0
Cloudfoundry ≫ Capi-release Version 1.27.0
Cloudfoundry ≫ Capi-release Version 1.28.0
Cloudfoundry ≫ Capi-release Version 1.29.0
Cloudfoundry ≫ Capi-release Version 1.30.0
Cloudfoundry ≫ Capi-release Version 1.31.0
Cloudfoundry ≫ Capi-release Version 1.32.0
Cloudfoundry ≫ Capi-release Version 1.33.0
Cloudfoundry ≫ Capi-release Version 1.34.0
Cloudfoundry ≫ Capi-release Version 1.35.0
Cloudfoundry ≫ Capi-release Version 1.36.0
Cloudfoundry ≫ Capi-release Version 1.37.0
Cloudfoundry ≫ Cf-release Version 245
Cloudfoundry ≫ Cf-release Version 246
Cloudfoundry ≫ Cf-release Version 247
Cloudfoundry ≫ Cf-release Version 248
Cloudfoundry ≫ Cf-release Version 249
Cloudfoundry ≫ Cf-release Version 250
Cloudfoundry ≫ Cf-release Version 251
Cloudfoundry ≫ Cf-release Version 252
Cloudfoundry ≫ Cf-release Version 253
Cloudfoundry ≫ Cf-release Version 254
Cloudfoundry ≫ Cf-release Version 255
Cloudfoundry ≫ Cf-release Version 256
Cloudfoundry ≫ Cf-release Version 257
Cloudfoundry ≫ Cf-release Version 258
Cloudfoundry ≫ Cf-release Version 259
Cloudfoundry ≫ Cf-release Version 260
Cloudfoundry ≫ Cf-release Version 261
Cloudfoundry ≫ Cf-release Version 262
Cloudfoundry ≫ Cf-release Version 263
Cloudfoundry ≫ Cf-release Version 264
Cloudfoundry ≫ Cf-release Version 265
Cloudfoundry ≫ Cf-release Version 266
Cloudfoundry ≫ Cf-release Version 267
Cloudfoundry ≫ Cf-release Version 268
Cloudfoundry ≫ Cf-release Version 269
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.42% 0.693
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.securityfocus.com/bid/100448
https://www.cloudfoundry.org/cve-2017-8037/
Vendor Advisory