CVE-2017-8040: XEE
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8040?
CVE-2017-8040 is classified as a medium severity vulnerability due to its potential for data exposure through an XML External Entity attack.
How do I fix CVE-2017-8040?
To fix CVE-2017-8040, you should upgrade to Pivotal Cloud Foundry Single Sign-On versions 1.3.4 or 1.4.3 or later.
What impact does CVE-2017-8040 have on affected systems?
CVE-2017-8040 can allow privileged users to upload malformed XML, leading to potential data leakage from the system.
Which versions of Pivotal Cloud Foundry are affected by CVE-2017-8040?
Versions 1.3.0, 1.3.2, 1.3.3, and 1.4.0, 1.4.1, 1.4.2 of Pivotal Cloud Foundry Single Sign-On are affected by CVE-2017-8040.
Is there a workaround for CVE-2017-8040 until I can upgrade?
There is no official workaround for CVE-2017-8040, so upgrading to a secure version is strongly recommended as the best mitigation.