CVE-2017-8035

HIGH

Cloud Foundry CAPI-release 1.7.0-1.34.0 and cf-release 245-267 - Unauthorized File Access via Cloud Controller API

Title source: llm
STIX 2.1

Description

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.cloudfoundry.org/cve-2017-8035/

Scores

CVSS v3 7.5
EPSS 0.0139
EPSS Percentile 68.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (3)
cloudfoundry/capi-release 1.7.0 - 1.35.0
cloudfoundry/cf-release 245 - 268
n/a/Cloud Controller Cloud Controller
Published Jul 25, 2017
Tracked Since Feb 18, 2026