An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to…
Priority LOW 26Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.
Why it matters now
EPSS 0.01086 65th percentileScored 2026-11-07
Fix Fixed org.cloudfoundry.identity:cloudfoundry-identity-server (Maven): 4.7.1, 4.5.3, 3.20.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1 | cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1 | — | No fix listed | CNA |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 4.6.0 to before 4.7.1 | 4.7.1 | Patch available | GHSA-j4p3-2m2h-cv5f |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 4.0.0 to before 4.5.3 | 4.5.3 | Patch available | GHSA-j4p3-2m2h-cv5f |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | before 3.20.1 | 3.20.1 | Patch available | GHSA-j4p3-2m2h-cv5f |
- cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1 Vendor— Affected cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1 Fixed in — No fix listed CNA
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 4.6.0 to before 4.7.1 Fixed in 4.7.1 Patch available GHSA-j4p3-2m2h-cv5f
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 4.0.0 to before 4.5.3 Fixed in 4.5.3 Patch available GHSA-j4p3-2m2h-cv5f
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected before 3.20.1 Fixed in 3.20.1 Patch available GHSA-j4p3-2m2h-cv5f
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:* | up to 278 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:uaa-release:*:*:*:*:*:*:*:* | 30 to before 30.6; 45 to before 45.4 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:uaa-release:52:*:*:*:*:*:*:* | 52 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:* Versions up to 278 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:uaa-release:*:*:*:*:*:*:*:* Versions 30 to before 30.6; 45 to before 45.4 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:uaa-release:52:*:*:*:*:*:*:* Versions 52 Vulnerable ·CloudFoundry Foundation
Remediation
- Fix · GHSA-j4p3-2m2h-cv5f org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 4.7.1 Advisory →
- Fix · GHSA-j4p3-2m2h-cv5f org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 4.5.3 Advisory →
- Fix · GHSA-j4p3-2m2h-cv5f org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.20.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8031
- 2026-10-03 Alias added: GHSA-j4p3-2m2h-cv5f
References
Other 9
- https://github.com/cloudfoundry/uaa/commit/1e2a746968cdac5b53164ca8955646e4257ecc7
- https://github.com/cloudfoundry/uaa/commit/20808046de8bbdc6fb2ac62829d4cc9d7a19f37
- https://github.com/cloudfoundry/uaa/commit/66166d17781aa257ff77a2fb7c69f72d0b611be
- https://github.com/cloudfoundry/uaa
- https://github.com/cloudfoundry/uaa/releases/tag/3.20.1
- https://github.com/cloudfoundry/uaa/releases/tag/4.5.3
- https://github.com/cloudfoundry/uaa/releases/tag/4.7.1
- https://web.archive.org/web/20200227134207/http://www.securityfocus.com/bid/101967
- https://www.cloudfoundry.org/cve-2017-8031
More CloudFoundry Foundation Cf-release vulnerabilities
- TI-2016-05702 Command injection in Cloud Foundry CVSS 3.0CRITICAL 9.8
- TI-2016-06771 Improper input validation in Cloud Foundry CVSS 3.0CRITICAL 9.8
- TI-2017-03116 Improper privilege management in Cloud Foundry CVSS 3.1CRITICAL 9.8
- TI-2015-04340 Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry… CVSS 3.1CRITICAL 9.8
- TI-2015-04339 The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA… CVSS 3.1CRITICAL 9.8
- TI-2016-05705 Applications in cf-release before 245 can be configured and pushed with a user-provided… CVSS 3.0CRITICAL 9.6
Sources
- CVE-2017-8031 · CVE Program
- CVE-2017-8031 · NVD
- FIRST EPSS
- GHSA-j4p3-2m2h-cv5f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences