PT-2017-18083 · Credhub · Credhub-Release

Published 2017-11-27 · Updated 2019-10-03 · CVE-2017-8038

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Credhub-release version 1.1.0

Description The issue allows authenticated applications to bypass access control lists (ACLs) and view any credential within the CredHub installation when using the CredHub interpolate endpoint.

Recommendations For Credhub-release version 1.1.0, consider restricting access to the CredHub interpolate endpoint until a patch is available.

Fix

Related Identifiers

CVE-2017-8038

Affected Products

Credhub-Release

References · 4

• https://osv.dev/vulnerability/CVE-2017-8038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8038 · Security Note
• https://cloudfoundry.org/cve-2017-8038 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8038 · Note