CVE-2019-3785

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.

Score

CVSS 3.1 8.1 High

Status

Modified - security_alert@emc.com

Published

2019-03-13

Last modified

2024-09-17

Weaknesses

CWE-269, CWE-285

Affected products

• Capi (Cloud Foundry)
• Capi-release (Cloudfoundry)

References

• http://www.securityfocus.com/bid/107514
• https://www.cloudfoundry.org/blog/cve-2019-3785