PT-2017-18076 · Cloud Foundry Foundation · Cf-Release+1

Published 2017-11-27 · Updated 2022-05-13 · CVE-2017-8031

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation cf-release versions prior to v279 UAA versions prior to 30.6 in the 30.x range UAA versions prior to 45.4 in the 45.x range UAA versions prior to 52.1 in the 52.x range

Description The issue allows an authenticated user for a particular client to revoke client tokens for other users on the same client, potentially causing denial of service. This occurs when the client is using opaque tokens or JWT tokens validated using the check token endpoint.

Recommendations For Cloud Foundry Foundation cf-release versions prior to v279, update to version v279 or later. For UAA 30.x versions prior to 30.6, update to version 30.6 or later. For UAA 45.x versions prior to 45.4, update to version 45.4 or later. For UAA 52.x versions prior to 52.1, update to version 52.1 or later.

Fix

Related Identifiers

CVE-2017-8031

GHSA-J4P3-2M2H-CV5F

Affected Products

Uaa

Cf-Release

References · 13

• https://osv.dev/vulnerability/GHSA-j4p3-2m2h-cv5f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8031 · Security Note
• https://github.com/cloudfoundry/uaa · Note
• https://github.com/cloudfoundry/uaa/releases/tag/4.7.1 · Note
• https://github.com/cloudfoundry/uaa/commit/66166d17781aa257ff77a2fb7c69f72d0b611be · Note
• https://github.com/cloudfoundry/uaa/commit/20808046de8bbdc6fb2ac62829d4cc9d7a19f37 · Note
• https://github.com/cloudfoundry/uaa/releases/tag/4.5.3 · Note
• https://github.com/cloudfoundry/uaa/releases/tag/3.20.1 · Note
• https://github.com/cloudfoundry/uaa/commit/1e2a746968cdac5b53164ca8955646e4257ecc7 · Note
• https://cloudfoundry.org/cve-2017-8031 · Note
• https://web.archive.org/web/20200227134207/http://securityfocus.com/bid/101967 · Note
• http://securityfocus.com/bid/101967 · Note