CVE-2017-8035: Infoleak
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8035?
CVE-2017-8035 has been classified as a medium-severity vulnerability.
How do I fix CVE-2017-8035?
To fix CVE-2017-8035, update the Cloud Foundry CAPI-release to version 1.35.0 or later, or the CF Release to version 268 or later.
Who is affected by CVE-2017-8035?
CVE-2017-8035 affects users of Cloud Foundry CAPI-release versions between 1.7.0 and 1.35.0, and CF Release versions between 245 and 268.
What is the impact of CVE-2017-8035?
The impact of CVE-2017-8035 allows unauthorized file access for Space Developers through a crafted CAPI request.
When was CVE-2017-8035 disclosed?
CVE-2017-8035 was disclosed in 2017 as part of ongoing security assessments of the Cloud Foundry platform.