CVE-2016-8218: Input Validation
An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8218?
CVE-2016-8218 is considered a high severity vulnerability due to its potential for user impersonation.
How do I fix CVE-2016-8218?
To fix CVE-2016-8218, upgrade to routing-release version 0.142.0 or higher, or cf-release version 232 or later.
Which versions are affected by CVE-2016-8218?
CVE-2016-8218 affects Cloud Foundry routing-release versions prior to 0.142.0 and cf-release versions 203 to 231.
What kind of attack does CVE-2016-8218 allow?
CVE-2016-8218 allows unprivileged attackers to impersonate other users to the routing API due to incomplete validation logic in JWT libraries.
Is CVE-2016-8218 easily exploitable?
Yes, CVE-2016-8218 can be exploited relatively easily by attackers who can create a valid JWT.