CWE Code: 434
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Unrestricted Upload of File with Dangerous Type
Summary: cloud foundry diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. a remote attacker with cf admin privileges can upload a malicious buildpack that will allow a complete takeover of a diego cell vm and access to all apps running on that diego cell.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-06-06
Last Modified Date: 2018-07-31