PT-2017-18083 · Credhub · Credhub-Release

Publicado 2017-11-27 · Atualizado 2019-10-03 · CVE-2017-8038

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Credhub-release version 1.1.0

Description The issue allows authenticated applications to bypass access control lists (ACLs) and view any credential within the CredHub installation when using the CredHub interpolate endpoint.

Recommendations For Credhub-release version 1.1.0, consider restricting access to the CredHub interpolate endpoint until a patch is available.

Correção

Identificadores relacionados

CVE-2017-8038

Produtos afetados

Credhub-Release

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-8038 · Aviso do Fabricante
• https://cloudfoundry.org/cve-2017-8038 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8038 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8038 · Nota de Segurança