« Volver al listado

CVE-2017-8041

Estado: ModificadaMedia (6.1)—

In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Single Sign-on FOR Pivotal Cloud Foundry

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8041",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3",
          "versions": [
            {
              "status": "affected",
              "version": "PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-09T01:29:03.707",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/100615",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://pivotal.io/security/cve-2017-8041",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/100615",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pivotal.io/security/cve-2017-8041",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name."
    },
    {
      "lang": "es",
      "value": "En Single Sign-On para Pivotal Cloud Foundry (PCF) en versiones 1.3.x anteriores a la 1.3.4 y en versiones 1.4.x anteriores a la 1.4.3, un usuario puede ejecutar un ataque XSS en ciertas páginas de la interfaz de usuario delservicio Single Sign-On introduciendo código en el campo de texto para un nombre de organización."
    }
  ],
  "lastModified": "2026-06-17T01:25:40.940",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3637F500-B290-4E67-9479-DDD225596E80"
            },
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57579759-CA64-4722-BAEC-6B111BB23BF7"
            },
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EDE1123-0E6A-4293-A84A-6C7D5E87C60C"
            },
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C23C2CCE-3943-48BC-AB44-FE6E19F1DF39"
            },
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2075D6CD-CC36-42C7-8F4D-E14E9B946367"
            },
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1C6E42F-0C08-4F77-8D42-1BEA8CCD38DA"
            },
            {
              "criteria": "cpe:2.3:a:vmware:single_sign-on_for_pivotal_cloud_foundry:1.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6ED7CDE4-3AF9-4171-8F63-1BE147487A02"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}