high8.1
CVE-2019-3785
Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization.
Impact
Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cloudfoundry | Capi-Release | before 1.78.0 |