In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release…
Priority LOW 37Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
Why it matters now
EPSS 0.01245 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Controller VM capi-release versions 1.33.0 and later, prior to 1.42.0, cf-release versions 268 and later, prior to 274 | Cloud Controller VM capi-release versions 1.33.0 and later, prior to 1.42.0, cf-release versions 268 and later, prior to 274 | — | No fix listed | CNA |
- Cloud Controller VM capi-release versions 1.33.0 and later, prior to 1.42.0, cf-release versions 268 and later, prior to 274 Vendor— Affected Cloud Controller VM capi-release versions 1.33.0 and later, prior to 1.42.0, cf-release versions 268 and later, prior to 274 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-release:268:*:*:*:*:*:*:* | 268 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cf-release:269:*:*:*:*:*:*:* | 269 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cf-release:270:*:*:*:*:*:*:* | 270 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cf-release:271:*:*:*:*:*:*:* | 271 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cf-release:272:*:*:*:*:*:*:* | 272 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cf-release:273:*:*:*:*:*:*:* | 273 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:pivotal:capi-release:1.33.0:*:*:*:*:*:*:* | 1.33.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.34.0:*:*:*:*:*:*:* | 1.34.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.35.0:*:*:*:*:*:*:* | 1.35.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.36.0:*:*:*:*:*:*:* | 1.36.0 | Vulnerable | Pivotal |
- cpe:2.3:a:cloudfoundry:cf-release:268:*:*:*:*:*:*:* Versions 268 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cf-release:269:*:*:*:*:*:*:* Versions 269 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cf-release:270:*:*:*:*:*:*:* Versions 270 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cf-release:271:*:*:*:*:*:*:* Versions 271 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cf-release:272:*:*:*:*:*:*:* Versions 272 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cf-release:273:*:*:*:*:*:*:* Versions 273 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:pivotal:capi-release:1.33.0:*:*:*:*:*:*:* Versions 1.33.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.34.0:*:*:*:*:*:*:* Versions 1.34.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.35.0:*:*:*:*:*:*:* Versions 1.35.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.36.0:*:*:*:*:*:*:* Versions 1.36.0 Vulnerable ·Pivotal
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal:capi-release:1.37.0:*:*:*:*:*:*:* | 1.37.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.38.0:*:*:*:*:*:*:* | 1.38.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.39.0:*:*:*:*:*:*:* | 1.39.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.40.0:*:*:*:*:*:*:* | 1.40.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:capi-release:1.41.0:*:*:*:*:*:*:* | 1.41.0 | Vulnerable | Pivotal |
- cpe:2.3:a:pivotal:capi-release:1.37.0:*:*:*:*:*:*:* Versions 1.37.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.38.0:*:*:*:*:*:*:* Versions 1.38.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.39.0:*:*:*:*:*:*:* Versions 1.39.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.40.0:*:*:*:*:*:*:* Versions 1.40.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:capi-release:1.41.0:*:*:*:*:*:*:* Versions 1.41.0 Vulnerable ·Pivotal
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8048
- 2026-10-03 Alias added: GHSA-9j8m-7rpr-659f
References
Sources
- CVE-2017-8048 · CVE Program
- CVE-2017-8048 · NVD
- FIRST EPSS
- GHSA-9j8m-7rpr-659f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences