How severe is CVE-2017-4970?

CVE-2017-4970 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2017-4970 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-4970?

CVE-2017-4970 primarily affects Cloudfoundry Cf-release. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-4970?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-4970 published?

CVE-2017-4970 was published on 2017-06-13 and last updated on 2026-06-17.

CVE-2017-4970

CVE-2017-4970 is a medium-severity vulnerability in Cloudfoundry Cf-release with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
CVSS v2: 4.3
EPSS exploit prediction: 1% (48th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Cloudfoundry Cf-release
Published: 2017-06-13
Last modified: 2026-06-17

Description

An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static file build pack causes the Staticfile.auth configuration to be ignored when the Static file file is not present in the application root. Applications containing a Staticfile.auth file but not a Static file had their basic auth turned off when an operator upgraded the Static file build pack in the foundation to one of the vulnerable versions. Note that Static file applications without a Static file are technically misconfigured, and will not successfully detect unless the Static file build pack is explicitly specified.

Frequently asked questions

What is CVE-2017-4970?: An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static file build pack causes the Staticfile.auth configuration to be ignored when the Static file file is not present in the application root. Applications containing a Staticfile.auth file but not a Static file had their basic auth turned off when an operator upgraded the Static file build pack in the foundation to one of the vulnerable versions. Note that Static file applications without a Static file are technically misconfigured, and will not successfully detect unless the Static file build pack is explicitly specified.
How severe is CVE-2017-4970?: CVE-2017-4970 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2017-4970 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-4970?: CVE-2017-4970 primarily affects Cloudfoundry Cf-release. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-4970?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-4970 published?: CVE-2017-4970 was published on 2017-06-13 and last updated on 2026-06-17.

References

https://www.cloudfoundry.org/cve-2017-4970/

Affected products (5)

cpe:2.3:a:cloudfoundry:cf-release:255:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.3:*:*:*:*:*:*:*

More vulnerabilities in Cloudfoundry Cf-release

CVE-2015-5172 — Critical (CVSS 9.8): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before…
CVE-2015-5171 — Critical (CVSS 9.8): The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud…
CVE-2017-4992 — Critical (CVSS 9.8): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior…
CVE-2016-8218 — Critical (CVSS 9.8): An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions…
CVE-2016-6655 — Critical (CVSS 9.8): An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release…
CVE-2016-6658 — Critical (CVSS 9.6): Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL…

All CVEs affecting Cloudfoundry Cf-release →