What’s Vulnerable › Vulnerabilities

CVE-2017-14389

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-28 · updated 2026-06-17

Description

An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."

Affected products

• Cloud Foundry CAPI: before 1.45.0 — fixed in 1.45.0
• Cloud Foundry cf-deployment: before 1.0.0 — fixed in 1.0.0
• Cloud Foundry Cloud Controller cf-release versions prior to v255: before 280 — fixed in 280

How to fix

Upgrade to a fixed version: Cloud Foundry CAPI 1.45.0; Cloud Foundry cf-deployment 1.0.0; Cloud Foundry Cloud Controller cf-release versions prior to v255 280. Check the vendor advisory for mitigations.

References

• https://www.cloudfoundry.org/cve-2017-14389/
• https://www.cloudfoundry.org/cve-2017-14389/

Get alerted when CVE-2017-14389 or the next vulnerability affects your stack