Read the docs
TI-2017-05630 Aliases CVE-2017-8037GHSA-9235-9qc9-8p4j

Information disclosure in Cloud Foundry

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.

Why it matters now

EPSS 0.01415 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cloud FoundryCloud Foundry—No fix listedCNA
  • Cloud Foundry Vendor— Affected Cloud Foundry Fixed in — No fix listed CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:capi-release:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.12.0:*:*:*:*:*:*:*1.12.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.13.0:*:*:*:*:*:*:*1.13.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.16.0:*:*:*:*:*:*:*1.16.0VulnerableCloudFoundry Foundation
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:capi-release:1.17.0:*:*:*:*:*:*:*1.17.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.18.0:*:*:*:*:*:*:*1.18.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.19.0:*:*:*:*:*:*:*1.19.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.20.0:*:*:*:*:*:*:*1.20.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.21.0:*:*:*:*:*:*:*1.21.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.22.0:*:*:*:*:*:*:*1.22.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.23.0:*:*:*:*:*:*:*1.23.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.24.0:*:*:*:*:*:*:*1.24.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.25.0:*:*:*:*:*:*:*1.25.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.26.0:*:*:*:*:*:*:*1.26.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.27.0:*:*:*:*:*:*:*1.27.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.28.0:*:*:*:*:*:*:*1.28.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.29.0:*:*:*:*:*:*:*1.29.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.30.0:*:*:*:*:*:*:*1.30.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.31.0:*:*:*:*:*:*:*1.31.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.32.0:*:*:*:*:*:*:*1.32.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.33.0:*:*:*:*:*:*:*1.33.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.34.0:*:*:*:*:*:*:*1.34.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.35.0:*:*:*:*:*:*:*1.35.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.36.0:*:*:*:*:*:*:*1.36.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:capi-release:1.37.0:*:*:*:*:*:*:*1.37.0VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:245:*:*:*:*:*:*:*245VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:246:*:*:*:*:*:*:*246VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:247:*:*:*:*:*:*:*247VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:248:*:*:*:*:*:*:*248VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:249:*:*:*:*:*:*:*249VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:250:*:*:*:*:*:*:*250VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:251:*:*:*:*:*:*:*251VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:252:*:*:*:*:*:*:*252VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:253:*:*:*:*:*:*:*253VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:254:*:*:*:*:*:*:*254VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:255:*:*:*:*:*:*:*255VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:256:*:*:*:*:*:*:*256VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:257:*:*:*:*:*:*:*257VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:258:*:*:*:*:*:*:*258VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:259:*:*:*:*:*:*:*259VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:260:*:*:*:*:*:*:*260VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:261:*:*:*:*:*:*:*261VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:262:*:*:*:*:*:*:*262VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:263:*:*:*:*:*:*:*263VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:264:*:*:*:*:*:*:*264VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:265:*:*:*:*:*:*:*265VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:266:*:*:*:*:*:*:*266VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:267:*:*:*:*:*:*:*267VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:268:*:*:*:*:*:*:*268VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cf-release:269:*:*:*:*:*:*:*269VulnerableCloudFoundry Foundation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-8037
  2. 2026-10-03 Alias added: GHSA-9235-9qc9-8p4j

References

Advisory 1

  • TI-2020-04463 Cloud Controller may allow developers to claim sensitive routes CVSS 3.1HIGH 8.8
  • TI-2018-01109 Insufficient session expiration in Dell EMC Cloud Controller CVSS 3.1HIGH 8.8
  • TI-2019-02799 Cloud Controller provides signed URL with write authorization to read only user CVSS 3.1HIGH 8.1
  • TI-2018-01171 Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure… CVSS 3.1HIGH 8.1
  • TI-2023-07297 Improper certificate validation in Cloud Controller API CVSS 3.1HIGH 8.1
  • TI-2017-05629 An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation… CVSS 3.1HIGH 7.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences