| Package | Affected versions | Patched versions |
|---|---|---|
| capi-release | ≤ 1.31.0 | |
| cf-release | ≤ 266 | |
| routing-release | ≤ 0.158.0 |
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free