CVE-2017-8031

lowPriorität · verfolgen · 21EPSS 0.011 · 65. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.09% (65th) EPSS

CVSS 3.5 · low

Is it mine?

8 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-28

An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.5–5.3

v2.03.5lowAV:N/AC:M/Au:S/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 6.8 · Auswirkung 2.9

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.6 · Auswirkung 3.6

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-401USLLM-abgeleitet

betroffene Produkte (8)

Betroffene Produkte und Versionsbereiche.

n/a cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1≤ cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1enisa_euvdEU
cloudfoundry cf-release≤ 278nvdUScpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*
cloudfoundry uaa-release30 → 30.6nvdUScpe:2.3:a:cloudfoundry:uaa-release:*:*:*:*:*:*:*:*
cloudfoundry uaa-release45 → 45.4nvdUScpe:2.3:a:cloudfoundry:uaa-release:*:*:*:*:*:*:*:*
cloudfoundry uaa-release= 52nvdUScpe:2.3:a:cloudfoundry:uaa-release:*:*:*:*:*:*:*:*
Maven org.cloudfoundry.identity:cloudfoundry-identity-server< 3.20.1osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
Maven org.cloudfoundry.identity:cloudfoundry-identity-server4.0.0 → 4.5.3osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
Maven org.cloudfoundry.identity:cloudfoundry-identity-server4.6.0 → 4.7.1osvUSpkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-j4p3-2m2h-cv5fCloud Foundry UAA Denial of Service through client token revocation endpoint2022-05-13ghsa · osvUS
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2017-11-27geändert 2026-06-17

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

https://www.cloudfoundry.org/cve-2017-8031/cnnvd
https://www.securityfocus.com/bid/101967 cnnvd
http://www.securityfocus.com/bid/101967 enisa_euvd
https://www.cloudfoundry.org/cve-2017-8031/enisa_euvd
http://www.securityfocus.com/bid/101967Third Party AdvisoryVDB Entrynvd
https://www.cloudfoundry.org/cve-2017-8031/Issue TrackingThird Party Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan