CVE-2019-3785 — Cloud Controller provides signed URL with write authorization to read only user

CVE-2019-3785

Cloud Controller provides signed URL with write authorization to read only user PUBLISHED

Description (CNA)

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.

Affected (CNA)

Vendor / product	Versions
Cloud Foundry / CAPI	affected All before 1.78.0

CWE

CWE-285

References

https://www.cloudfoundry.org/blog/cve-2019-3785
http://www.securityfocus.com/bid/107514

ADP enrichment

CVE

No English description supplied.

https://www.cloudfoundry.org/blog/cve-2019-3785
http://www.securityfocus.com/bid/107514