Read the docs

CloudFoundry Foundation

Records118All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high64CVSS 7.0–8.9

Exploited now

CloudFoundry Foundation records in CISA KEV

No CloudFoundry Foundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cf-deployment 37 records MEDIUM Cf-release 35 records MEDIUM Capi-release 22 records MEDIUM Cloud Foundry Uaa Bosh 15 records MEDIUM User Account And Authentication 9 records MEDIUM Routing-release 8 records MEDIUM Routing Release 5 records LOW Uaa Release 5 records MEDIUM

Records

35 records in Cf-release · all components

TI-2016-05702 CVE-2016-6655 · GHSA-4rmm-hmcx-2hg3

Command injection in Cloud Foundry

Priority MEDIUM 48

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0341 Published 2017-06-13 No fix listed CWE-77
TI-2016-06771 CVE-2016-8218 · GHSA-vc7q-m69g-gmvq

Improper input validation in Cloud Foundry

Priority MEDIUM 45

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01297 Published 2017-06-13 No fix listed CWE-20
TI-2017-03116 CVE-2017-4992 · GHSA-jcmh-x32v-7mgf

Improper privilege management in Cloud Foundry

Priority MEDIUM 44

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions pri…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01167 Published 2017-06-13 Fixed in 2.7.4.17, 3.6.11 +2 CWE-269
TI-2015-04340 CVE-2015-5172 · GHSA-cq6m-74r4-x77g

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry…

Priority MEDIUM 44

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01167 Published 2017-10-24 Fixed in 2.5.2 CWE-640
TI-2015-04339 CVE-2015-5171 · GHSA-h533-q6jc-qx28

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA…

Priority MEDIUM 44

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging fa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01167 Published 2017-10-24 Fixed in 2.5.2 CWE-613
TI-2018-01109 CVE-2018-1195 · GHSA-mxfj-x685-fxwf

Insufficient session expiration in Dell EMC Cloud Controller

Priority MEDIUM 40

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00983 Published 2018-03-19 No fix listed CWE-613
TI-2016-00656 CVE-2016-0732 · GHSA-4987-rr6v-x4q5

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through…

Priority MEDIUM 40

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allo…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01154 Published 2017-09-07 No fix listed CWE-269
TI-2015-04341 CVE-2015-5173 · GHSA-pvw6-76ww-4x7m

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry…

Priority MEDIUM 40

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery l…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01033 Published 2017-10-24 No fix listed CWE-200
TI-2015-04338 CVE-2015-5170 · GHSA-mpv3-g527-fqrj

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry…

Priority LOW 39

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a use…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00757 Published 2017-10-24 Fixed in 2.5.2 CWE-352
TI-2015-02822 CVE-2015-3191 · GHSA-442q-44xh-2275

Cross-site request forgery in Pivotal Cloud Foundry

Priority LOW 39

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00486 Published 2017-05-25 No fix listed CWE-352
TI-2017-05630 CVE-2017-8037 · GHSA-9235-9qc9-8p4j

Information disclosure in Cloud Foundry

Priority LOW 36

In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01415 Published 2017-08-21 No fix listed CWE-200
TI-2017-05628 CVE-2017-8035 · GHSA-5hx9-w49q-v9p8

Information disclosure in Cloud Controller

Priority LOW 36

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01387 Published 2017-07-25 No fix listed CWE-200
TI-2017-03096 CVE-2017-4972 · GHSA-5w93-xgv6-rpgw

SQL injection in Cloud Foundry UAA

Priority LOW 35

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prio…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01085 Published 2017-06-13 No fix listed CWE-89
TI-2016-00698 CVE-2016-0780 · GHSA-68vw-f384-v6m6

Resource management flaw in Pivotal Cloud Foundry

Priority LOW 35

It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtime 1.6.x versions prior to 1.6.18 do not properly enforce disk…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01245 Published 2017-05-25 No fix listed CWE-399
TI-2017-03115 CVE-2017-4991 · GHSA-cgrg-x34r-78f3

Improper privilege management in Cloud Foundry UAA

Priority LOW 33

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions pri…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00936 Published 2017-06-13 Fixed in 2.7.4.16, 3.6.10 +2 CWE-269
TI-2015-01647 CVE-2015-1834 · GHSA-xmcg-5rvr-g4j6

Path traversal in Pivotal Cloud Foundry

Priority LOW 32

A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01685 Published 2017-05-25 No fix listed CWE-22
TI-2017-05627 CVE-2017-8034 · GHSA-47fq-mm42-6v8w

The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to…

Priority LOW 31

The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens…

CVSS 3.0MEDIUM 6.6 Network High privileges No interaction EPSS 0.00751 Published 2017-07-17 No fix listed CWE-565
TI-2017-03098 CVE-2017-4974 · GHSA-cw9c-v3v2-99hm

SQL injection in Cloud Foundry UAA

Priority LOW 31

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prio…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00974 Published 2017-06-13 Fixed in 2.7.4.15, 3.6.9 +2 CWE-89
TI-2016-06772 CVE-2016-8219 · GHSA-w6w3-q7mh-r859

Improper privilege management in Cloud Foundry

Priority LOW 31

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00974 Published 2017-06-13 No fix listed CWE-269
Load more
Open these records in search →