{"id":"CVE-2017-8033","published":"2017-07-25T04:00:00Z","modified":"2024-08-05T16:19:29Z","title":"An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0…","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01018,"percentile":0.63235,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.cloudfoundry.org/cve-2017-8033/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":12.65}]},"affectedVersions":[{"vendor":"n/a","product":"Cloud Controller API CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268","versions":["Cloud Controller API CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268"]}],"euvd":{"id":"EUVD-2017-17000","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2017-8036-family-cve-2017-8036","children":[{"from":"CVE-2017-8033","to":"CVE-2017-8036","relation":"regression","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application.","from":"CVE.org","in":"CVE-2017-8036"}]},{"from":"CVE-2017-8033","to":"CVE-2017-8048","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"…se versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Contro…","from":"CVE.org","in":"CVE-2017-8048"}]}]}}