CVE-2017-8044 Cross-site scripting in Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3
Attackers can inject malicious code into the DOM via query parameters, enabling XSS attacks against users of Pivotal Single Sign-On for PCF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-8044?
CVE-2017-8044 is a medium-severity cross-site scripting vulnerability in Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, published on 27 Nov 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks.
Weakness: CWE-79
Which versions are affected by CVE-2017-8044?
It affects 1 product.
Products include Vmware Single Sign-on for Pivotal Cloud Foundry.
How do I fix CVE-2017-8044?
No fix has been published for CVE-2017-8044 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-8044 being exploited?
There is no known exploitation of CVE-2017-8044 in the wild and no public exploit code.
Other vulnerabilities in Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3
Sources
Also known as GHSA-x62g-3rgq-g655.