CVE-2017-8031
published 2017-11-27CVE-2017-8031: An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4…
PriorityP425medium5.3CVSS 3.1
AVNACHPRLUINSUCNINAH
EPSS
1.09%
61.2th percentile
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudfoundry | cf-release | <= 278 | — |
| cloudfoundry | uaa-release | — | — |
| cloudfoundry | uaa-release | >= 30 < 30.6 | 30.6 |
| cloudfoundry | uaa-release | >= 45 < 45.4 | 45.4 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cloud Foundry UAA Denial of Service through client token revocation endpoint
osv·2022-05-13
CVE-2017-8031 [MEDIUM] Cloud Foundry UAA Denial of Service through client token revocation endpoint
Cloud Foundry UAA Denial of Service through client token revocation endpoint
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.
GHSA
Cloud Foundry UAA Denial of Service through client token revocation endpoint
ghsa·2022-05-13
CVE-2017-8031 [MEDIUM] Cloud Foundry UAA Denial of Service through client token revocation endpoint
Cloud Foundry UAA Denial of Service through client token revocation endpoint
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-11-27
Published