CVE-2017-8040

In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.

• CWE-611

• http://www.securityfocus.com/bid/100617Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2017-8040Patch, Vendor Advisory
• http://www.securityfocus.com/bid/100617Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2017-8040Patch, Vendor Advisory

Published

Sep 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8034The Cloud Controller and Router in Cloud Foundry (CAPI-relea…
• CVE-2017-8035An issue was discovered in the Cloud Controller API in Cloud…7.5
• CVE-2017-8036An issue was discovered in the Cloud Controller API in Cloud…7.8
• CVE-2017-8037In Cloud Foundry Foundation CAPI-release versions after v1.6…
• CVE-2017-8038In Cloud Foundry Foundation Credhub-release version 1.1.0, a…
• CVE-2017-8039An issue was discovered in Pivotal Spring Web Flow through 2…
• CVE-2017-8041In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x vers…6.1
• CVE-2017-8042Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8043Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8044In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1…6.1
• CVE-2017-8045In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and …
• CVE-2017-8046Malicious PATCH requests submitted to servers using Spring D…9.8