CVE-2017-4964

HIGH

Cloud Foundry Foundation BOSH Azure CPI v22 - Code Injection

Title source: llm

Description

Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created by the director, aka a "CPI code injection vulnerability."

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_confirm

https://www.cloudfoundry.org/cve-2017-4964/

Scores

CVSS v3 8.8

EPSS 0.0046

EPSS Percentile 36.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-94

Status published

Products (2)

cloudfoundry/bosh_azure_cpi 22

n/a/Cloud Foundry Foundation BOSH Azure CPI Release v22 Cloud Foundry Foundation BOSH Azure CPI Release v22

Published Apr 06, 2017

Tracked Since Feb 18, 2026