Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Link | Tags |
|---|---|
| https://www.cloudfoundry.org/blog/cve-2019-3785 | vendor advisory |
| http://www.securityfocus.com/bid/107514 | vdb entry third party advisory |