Description
An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Cloud Foundry capi-release: All versions prior to 1.45.0, cf-release: All versions prior to v280, cf-deployment: All versions prior to v1.0.0 | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2017-5892 | An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover." |
References
| Link | Providers |
|---|---|
| https://www.cloudfoundry.org/cve-2017-14389/ |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: dell
Published:
Updated: 2024-08-05T19:27:40.603Z
Reserved: 2017-09-12T00:00:00.000Z
Link: CVE-2017-14389
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2017-11-28T07:29:00.303
Modified: 2025-04-20T01:37:25.860
Link: CVE-2017-14389
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses