CVE-2017-8040 XML external entity in PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3
Privileged users can exploit an XXE vulnerability in the PCF Single Sign-On dashboard to expose data from the service broker file system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8040?
CVE-2017-8040 is a medium-severity vulnerability in PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3, published on 9 Sep 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.
Weakness: CWE-611
Which versions are affected by CVE-2017-8040?
It affects 1 product.
Products include Vmware Single Sign-on for Pivotal Cloud Foundry.
How do I fix CVE-2017-8040?
No fix has been published for CVE-2017-8040 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8040 being exploited?
There is no known exploitation of CVE-2017-8040 in the wild and no public exploit code.
Other vulnerabilities in PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3
Sources
Also known as GHSA-fc7r-qxmj-ff6j.