Cloud Controller provides signed URL with write authorization to read only user
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.3%
probabilidade de exploração
1.3%top 33% das CVEs
exploração observada
nãonenhuma fonte reporta
Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Cloud Foundry · CAPI