7.2

CVE-2017-4991: cloudfoundry cf-release Improper Privilege Management

CVSS: 7.2v3.1HighModified
AliasesGHSA-cgrg-x34r-78f3
Published 13-06-2017Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-4991 is a high (CVSS 7.2) Improper Privilege Management vulnerability in cloudfoundry cf-release. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.1% of scored vulnerabilities.

Overall risk
29/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.2/10
010
High · v3.1 (NVD)
EPSS score
0.94%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-06-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.

CVSS metrics

3 scores · 2 sources · 3 versions

EPSS trend

Probability

0.94%

Chance of exploitation in the next 30 days

Percentile

60%

Versus all other CVEs

30-day change

0.00 pp

From 0.94% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.94%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cloudfoundry2 products
  • cf-release≤ 259
  • cloud_foundry_uaa_bosh≤ 35 | 13.1 | 13.2 | 13.3 | 13.4 | 13.5 | 13.6 | 13.7 | 13.8 | 13.9 | 13.10 | 13.11 | 13.12 | 13.13 | 24 | 24.1 | 24.2 | 24.3 | 24.4 | 24.5 | 24.6 | 24.7 | 24.8 | 24.9 | 24.10 | 30 | 30.1
Org.cloudfoundry.identity1 product
  • cloudfoundry-identity-server≥ 2.0.0, < 2.7.4.16 | ≥ 3.0.0, < 3.6.10 | ≥ 3.7.0, < 3.9.12 | ≥ 3.10.0, < 3.17.0
Pivotal_software1 product
  • cloud_foundry_uaa≤ 4.2.0 | 2.2.5.4 | 2.7.1 | 2.7.2 | 2.7.3 | 2.7.4 | 2.7.4.1 | 2.7.4.2 | 2.7.4.3 | 2.7.4.4 | 2.7.4.5 | 2.7.4.6 | 2.7.4.7 | 2.7.4.8 | 2.7.4.9 | 2.7.4.11 | 2.7.4.12 | 2.7.4.13 | 2.7.4.14 | 2.7.4.15 | 3.6.1 | 3.6.2 | 3.6.3 | 3.6.4 | 3.6.5 | 3.6.6 | 3.6.7 | 3.6.8 | 3.6.9 | 3.9.1 | 3.9.2 | 3.9.3 | 3.9.4 | 3.9.5 | 3.9.6 | 3.9.7 | 3.9.8 | 3.9.9

3 vendors · 4 products

References

8 links