CRITICAL🇵🇱 Wersja polska

CVE-2016-8218

CVSS 9.8v3.0pub. 2017-06-13upd. 2026-05-13

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cloudfoundry Cf Release

    APP
    Cloudfoundry
    204205206207208209210211212213214215217218219+ 13 more

  • Cloudfoundry Routing Release

    APP
    Cloudfoundry
    ≤ 0.141.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2016-6658CRITICAL9.6PL ✓same product

Ujawnienie danych uwierzytelniających buildpack w Cloud Foundry CF-Release

CVE-2015-5172CRITICAL9.8PL ✓same product

Cloud Foundry: brak wygasania linków resetowania hasła

CVE-2015-5171CRITICAL9.8PL ✓same product

Cloud Foundry: brak unieważniania sesji po zmianie hasła

CVE-2016-6655CRITICAL9.8PL ✓same product

Command injection w skryptach Cloud Foundry i cf-mysql-release

CVE-2017-4992CRITICAL9.8PL ✓same product

Cloud Foundry UAA: privilege escalation przez mechanizm zaproszeń użytkowników