CVE-2017-14389
Medium
Description
An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."
SeverityMedium
CVSS6.5
Exploit probability—
ProductCloudfoundry Capi-release
PublishedNov 28, 2017
First seenNov 28, 2017
How to fix
Update
- cloudfoundry capi-release1.45.0 or later
- cloudfoundry cf-deployment1.0.0 or later
- cloudfoundry cf-release280 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry capi-release | v < 1.45.0 | 1.45.0 |
| cloudfoundry cf-deployment | v < 1.0.0 | 1.0.0 |
| cloudfoundry cf-release | v < 280 | 280 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.