Medium
Security advisory
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-8034
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:05 UTC · Revision 1
Source evidence
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
osv:CVE-2017-8034
Complete source record
{
"id": "dffc094b8ef22cf00b6e827bebfcdb148178b7efd056eda22f089ad49c52a688",
"url": "https://osv.dev/vulnerability/CVE-2017-8034",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-8034",
"summary": "The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.",
"evidence": "osv:CVE-2017-8034",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-8034",
"aliases": [
"CVE-2017-8034"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cloudfoundry-attic/cf-release",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "715b43f9943503f4ea3d23a2c48ccc37e9d5fecc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "266"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v266",
"v262",
"v260",
"v253",
"v249",
"v245",
"v205",
"v183",
"v170",
"v161",
"v157",
"v156",
"rc145.0",
"v143",
"works-for-us",
"v140",
"v137",
"v136",
"v135",
"v134",
"v133",
"v132",
"scotty_09012012",
"v119",
"v109",
"v105",
"v104",
"v103",
"v102",
"v100",
"v99",
"-",
"log",
"list"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8034.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/cloudfoundry/capi-release",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "13b17376cd84b4af6cbd601cb242e7661310f0c7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cloudfoundry:capi-release:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.31.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.28.0",
"1.31.0",
"1.30.0",
"1.27.0",
"1.26.0",
"1.25.0",
"1.24.0",
"1.23.0",
"1.22.0",
"1.21.0",
"1.20.0",
"1.19.0",
"1.16.0",
"1.15.0",
"1.14.0",
"1.13.0",
"1.12.0",
"1.11.0",
"1.10.0",
"1.9.0",
"1.8.0",
"1.7.0",
"1.6.0",
"1.5.0",
"1.4.0",
"1.3.0",
"1.2.0",
"1.1.0",
"v1.0.0",
"1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8034.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/cloudfoundry/routing-release",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0a16bb1da4e298061cd51f363298c3f422e3673b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.158.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"0.158.0",
"0.157.0",
"0.154.0",
"0.147.0",
"0.142.0",
"0.137.0",
"0.136.0",
"0.134.0",
"0.123.0",
"0.121.0",
"0.118.0",
"0.99.0",
"0.69.0",
"0.66.0",
"0.62.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8034.json"
}
}
],
"modified": "2026-10-24T10:30:35.144855691Z",
"provider": "osv",
"references": [
"https://www.cloudfoundry.org/cve-2017-8034/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:cloudfoundry:capi-release:*:*:*:*:*:*:*:*"
],
"vendor_product": "cloudfoundry:capi-release",
"extracted_events": [
{
"range": [
{
"last_affected": "1.31.0"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-8034",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 433683,
"published_at": "2017-07-17T14:29:01.28+00:00"
}