How severe is CVE-2017-8048?

CVE-2017-8048 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-8048 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-8048?

CVE-2017-8048 primarily affects Cloudfoundry Cf-release. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-8048?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-8048 published?

CVE-2017-8048 was published on 2017-10-04 and last updated on 2026-06-17.

CVE-2017-8048

CVE-2017-8048 is a high-severity vulnerability in Cloudfoundry Cf-release with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 6.8
EPSS exploit prediction: 1% (66th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Cloudfoundry Cf-release
Published: 2017-10-04
Last modified: 2026-06-17

Description

In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.

Frequently asked questions

What is CVE-2017-8048?: In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
How severe is CVE-2017-8048?: CVE-2017-8048 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-8048 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-8048?: CVE-2017-8048 primarily affects Cloudfoundry Cf-release. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-8048?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-8048 published?: CVE-2017-8048 was published on 2017-10-04 and last updated on 2026-06-17.

References

https://www.cloudfoundry.org/cve-2017-8048/

Affected products (15)

cpe:2.3:a:cloudfoundry:cf-release:268:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:cf-release:269:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:cf-release:270:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:cf-release:271:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:cf-release:272:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:cf-release:273:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.33.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.34.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.35.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.36.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.37.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.38.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.39.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.40.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal:capi-release:1.41.0:*:*:*:*:*:*:*

More vulnerabilities in Cloudfoundry Cf-release

CVE-2015-5172 — Critical (CVSS 9.8): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before…
CVE-2015-5171 — Critical (CVSS 9.8): The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud…
CVE-2017-4992 — Critical (CVSS 9.8): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior…
CVE-2016-8218 — Critical (CVSS 9.8): An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions…
CVE-2016-6655 — Critical (CVSS 9.8): An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release…
CVE-2016-6658 — Critical (CVSS 9.6): Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL…

All CVEs affecting Cloudfoundry Cf-release →