CVE-2016-8218 — Improper Input Validation in Cf-release

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.6%
top 30.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cloudfoundry Cf-releaseCloudfoundry Routing-release
Timeline
PublishedJun 13
Latest updateMay 17

Description

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

Patches

Patch: www.cloudfoundry.org ↗Patch: www.cloudfoundry.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-vc7q-m69g-gmvq: An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0↗2022-05-17
▶
CVEList
CVE-2016-8218: An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0↗2017-06-13
▶
CVE-2016-8218 — Improper Input Validation in Cf-release | cvebase