CVE-2017-8034

mediumpriority · track · 26EPSS 0.008 · 55 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.75% (55th) EPSS

CVSS 6 · medium

Is it mine?

4 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-28

The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.

cvss

Technical severity, 0–10. One row per scoring source.

6.6

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.06mediumAV:N/AC:M/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 6.8 · impact 6.4

v3.06.6mediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 0.7 · impact 5.9

v3.06.1mediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-565USprimary

affected products (4)

Products and version ranges known to be affected.

n/a Cloud Foundry≤ Cloud Foundryenisa_euvdEU
cloudfoundry capi-release≤ 1.31.0nvdUScpe:2.3:a:cloudfoundry:capi-release:*:*:*:*:*:*:*:*
cloudfoundry cf-release≤ 266nvdUScpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*
cloudfoundry routing-release≤ 0.158.0nvdUScpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2017-07-17modified 2026-06-17

related (89)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-0257US	critical9.1OT critical	95.0% (100th)	KEV	2026-05-13
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establi…
CVE-2023-35885US	critical9.8	73.5% (99th)	Exploit	2023-06-20
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
CVE-2008-5784US	critical9.8	7.10% (94th)	Exploit	2008-12-31
V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
CVE-2026-39324US	critical9.8OT high	0.27% (19th)	Exploit	2026-04-07
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secret…
CVE-2017-6896US	high8.8	3.70% (90th)	Exploit	2017-03-14
Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Bas…

+84 more

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan