Cross-site scripting in Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x…
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks.
Why it matters now
EPSS 0.00877 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3 | Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3 | — | No fix listed | CNA |
- Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3 Vendor— Affected Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.2:*:*:*:*:*:*:* | 1.3.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.3:*:*:*:*:*:*:* | 1.3.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.1:*:*:*:*:*:*:* | 1.4.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.2:*:*:*:*:*:*:* | 1.4.2 | Vulnerable | VMware |
- cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·VMware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8044
- 2026-10-03 Alias added: GHSA-x62g-3rgq-g655
References
More VMware Single Sign-on For Pivotal Cloud Foundry vulnerabilities
- TI-2017-05633 XML external entity injection in PCF Single Sign-On for PCF:1.3.x versions prior to… CVSS 3.1MEDIUM 6.5
- TI-2017-05634 Cross-site scripting in PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-8044 · CVE Program
- CVE-2017-8044 · NVD
- FIRST EPSS
- GHSA-x62g-3rgq-g655 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences