CVE-2017-8037

In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.

• CWE-200

• http://www.securityfocus.com/bid/100448
• https://www.cloudfoundry.org/cve-2017-8037/Vendor Advisory
• http://www.securityfocus.com/bid/100448
• https://www.cloudfoundry.org/cve-2017-8037/Vendor Advisory

Published

Aug 21, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8031An issue was discovered in Cloud Foundry Foundation cf-relea…5.3
• CVE-2017-8032In Cloud Foundry cf-release versions prior to v264; UAA rele…
• CVE-2017-8033An issue was discovered in the Cloud Controller API in Cloud…7.8
• CVE-2017-8034The Cloud Controller and Router in Cloud Foundry (CAPI-relea…
• CVE-2017-8035An issue was discovered in the Cloud Controller API in Cloud…7.5
• CVE-2017-8036An issue was discovered in the Cloud Controller API in Cloud…7.8
• CVE-2017-8038In Cloud Foundry Foundation Credhub-release version 1.1.0, a…
• CVE-2017-8039An issue was discovered in Pivotal Spring Web Flow through 2…
• CVE-2017-8040In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x vers…6.5
• CVE-2017-8041In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x vers…6.1
• CVE-2017-8042Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8043Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…