CVE-2017-8044: XSS
Published Nov 27, 2017
·Updated
In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks.
Affected Software
5 affected components
VMware Single Sign-on For Pivotal Cloud Foundry=1.3.0
VMware Single Sign-on For Pivotal Cloud Foundry=1.3.2
VMware Single Sign-on For Pivotal Cloud Foundry=1.3.3
VMware Single Sign-on For Pivotal Cloud Foundry=1.4.1
VMware Single Sign-on For Pivotal Cloud Foundry=1.4.2
Event History
Nov 27, 2017
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-8044?
CVE-2017-8044 is considered a high severity vulnerability due to its potential to allow XSS attacks.
2
How do I fix CVE-2017-8044?
To fix CVE-2017-8044, upgrade Pivotal Single Sign-On to version 1.3.4 or 1.4.3 or later.
3
What impact does CVE-2017-8044 have?
CVE-2017-8044 can lead to code injection into the DOM, enabling attackers to execute malicious scripts in the user's browser.
4
Which versions of Pivotal Single Sign-On are affected by CVE-2017-8044?
CVE-2017-8044 affects Pivotal Single Sign-On versions 1.3.0 to 1.3.3 and 1.4.1 to 1.4.2.
5
Is there a workaround for CVE-2017-8044?
There are no official workarounds for CVE-2017-8044; upgrading to a patched version is recommended.