What is CVE-2016-8218?

CVE-2016-8218 is a critical-severity vulnerability in Cloudfoundry Cf-Release, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2017-06-13.

How severe is CVE-2016-8218?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Improper input validation in Cloudfoundry Cf-Release

CVE-2016-8218

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.013 (68.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cloudfoundry Cf-release — versions 204, 205, 206
Cloudfoundry Routing-release
N/a Cloud Foundry — versions Cloud Foundry

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security_alert@emc.com (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2016-8218?: CVE-2016-8218 is a critical-severity vulnerability in Cloudfoundry Cf-Release, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2017-06-13.
How severe is CVE-2016-8218?: Critical severity. CVSS v3 base score is 9.8 out of 10.