CWE Code: 565
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Reliance on Cookies without Validation and Integrity Checking
Summary: the cloud controller and router in cloud foundry (capi-release capi versions prior to v1.32.0, routing-release versions prior to v0.159.0, cf-release versions prior to v267) do not validate the issuer on json web tokens (jwts) from uaa. with certain multi-zone uaa configurations, zone administrators are able to escalate their privileges.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-07-17
Last Modified Date: 2019-10-03