CVE-2018-1265

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers

published June 6, 2018

CVSS
—
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01743 · 77.6th percentile
Published
2018-06-06T20:00Z
EPSS history
Timeline
  • 06 JUN 20:00Z
    Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers
    cvelistv5