CVEvulnerability

CVE-2016-8218

9.8 CRITICAL Published 2017-06-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-06-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.

Affected configurations

• cloudfoundry cf-release (<= 203) • cloudfoundry cf-release 204 • cloudfoundry cf-release 205 • cloudfoundry cf-release 206 • cloudfoundry cf-release 207 • cloudfoundry cf-release 208 • cloudfoundry cf-release 209 • cloudfoundry cf-release 210 • cloudfoundry cf-release 211 • cloudfoundry cf-release 212 • cloudfoundry cf-release 213 • cloudfoundry cf-release 214 • cloudfoundry cf-release 215 • cloudfoundry cf-release 217 • cloudfoundry cf-release 218 • cloudfoundry cf-release 219 • cloudfoundry cf-release 220 • cloudfoundry cf-release 221 • cloudfoundry cf-release 222 • cloudfoundry cf-release 223 • cloudfoundry cf-release 224 • cloudfoundry cf-release 225 • cloudfoundry cf-release 226 • cloudfoundry cf-release 227 • cloudfoundry cf-release 228 • cloudfoundry cf-release 229 • cloudfoundry cf-release 230 • cloudfoundry cf-release 231 • cloudfoundry routing-release (<= 0.141.0)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References