CVE-2017-8031

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-27 · updated 2026-06-17

Description

An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.

Affected products

Cloud Foundry Cloud Controller cf-release versions prior to v255: through 278
Cloudfoundry Uaa-Release: from 30 before 30.6; from 45 before 45.4; 52 — fixed in 30.6, 45.4

How to fix

Upgrade to a fixed version: Cloudfoundry Uaa-Release 30.6, 45.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-8031 or the next vulnerability affects your stack