{"id":"CVE-2017-8032","details":"In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.","aliases":["GHSA-9frw-wmvq-5rrc"],"modified":"2026-08-27T03:47:38.634197231Z","published":"2017-07-10T20:29:00.860Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"last_affected":"263"}],"source":"CPE_RANGE","vendor_product":"pivotal_software:cloud_foundry_cf","cpes":["cpe:2.3:a:pivotal_software:cloud_foundry_cf:*:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"2.2.5.4"},{"last_affected":"2.2.5.4"},{"introduced":"2.2.5.4"},{"last_affected":"2.2.5.4"}],"source":"CPE_STRING","vendor_product":"pivotal_software:cloud_foundry_uaa","cpes":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://www.cloudfoundry.org/cve-2017-8032/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa","events":[{"introduced":"7640c1433ec193b6696ee5e37a524a353fb3053e"},{"last_affected":"99af707ee74042406449c8aa5081d2acb03a6669"}],"database_specific":{"cpe":["cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.16:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.10:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.12:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.10:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.12:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.13:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.14:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.2.5.4"},{"last_affected":"2.2.5.4"},{"introduced":"2.7.1"},{"last_affected":"2.7.1"},{"introduced":"2.7.2"},{"last_affected":"2.7.2"},{"introduced":"2.7.3"},{"last_affected":"2.7.3"},{"introduced":"2.7.4"},{"last_affected":"2.7.4"},{"introduced":"2.7.4.1"},{"last_affected":"2.7.4.1"},{"introduced":"2.7.4.2"},{"last_affected":"2.7.4.2"},{"introduced":"2.7.4.3"},{"last_affected":"2.7.4.3"},{"introduced":"2.7.4.4"},{"last_affected":"2.7.4.4"},{"introduced":"2.7.4.5"},{"last_affected":"2.7.4.5"},{"introduced":"2.7.4.6"},{"last_affected":"2.7.4.6"},{"introduced":"2.7.4.7"},{"last_affected":"2.7.4.7"},{"introduced":"2.7.4.8"},{"last_affected":"2.7.4.8"},{"introduced":"2.7.4.9"},{"last_affected":"2.7.4.9"},{"introduced":"2.7.4.11"},{"last_affected":"2.7.4.11"},{"introduced":"2.7.4.12"},{"last_affected":"2.7.4.12"},{"introduced":"2.7.4.13"},{"last_affected":"2.7.4.13"},{"introduced":"2.7.4.14"},{"last_affected":"2.7.4.14"},{"introduced":"2.7.4.15"},{"last_affected":"2.7.4.15"},{"introduced":"2.7.4.16"},{"last_affected":"2.7.4.16"},{"introduced":"3.6.1"},{"last_affected":"3.6.1"},{"introduced":"3.6.2"},{"last_affected":"3.6.2"},{"introduced":"3.6.3"},{"last_affected":"3.6.3"},{"introduced":"3.6.4"},{"last_affected":"3.6.4"},{"introduced":"3.6.5"},{"last_affected":"3.6.5"},{"introduced":"3.6.6"},{"last_affected":"3.6.6"},{"introduced":"3.6.7"},{"last_affected":"3.6.7"},{"introduced":"3.6.8"},{"last_affected":"3.6.8"},{"introduced":"3.6.9"},{"last_affected":"3.6.9"},{"introduced":"3.6.10"},{"last_affected":"3.6.10"},{"introduced":"3.6.11"},{"last_affected":"3.6.11"},{"introduced":"3.6.12"},{"last_affected":"3.6.12"},{"introduced":"3.9.1"},{"last_affected":"3.9.1"},{"introduced":"3.9.2"},{"last_affected":"3.9.2"},{"introduced":"3.9.3"},{"last_affected":"3.9.3"},{"introduced":"3.9.4"},{"last_affected":"3.9.4"},{"introduced":"3.9.5"},{"last_affected":"3.9.5"},{"introduced":"3.9.6"},{"last_affected":"3.9.6"},{"introduced":"3.9.7"},{"last_affected":"3.9.7"},{"introduced":"3.9.8"},{"last_affected":"3.9.8"},{"introduced":"3.9.9"},{"last_affected":"3.9.9"},{"introduced":"3.9.10"},{"last_affected":"3.9.10"},{"introduced":"3.9.11"},{"last_affected":"3.9.11"},{"introduced":"3.9.12"},{"last_affected":"3.9.12"},{"introduced":"3.9.13"},{"last_affected":"3.9.13"},{"introduced":"3.9.14"},{"last_affected":"3.9.14"}],"source":"CPE_STRING"}}],"versions":["2.2.5.4","2.7.1","2.7.2","2.7.3","2.7.4","2.7.4.1","2.7.4.11","2.7.4.12","2.7.4.13","2.7.4.14","2.7.4.15","2.7.4.16","2.7.4.2","2.7.4.3","2.7.4.4","2.7.4.5","2.7.4.6","2.7.4.7","2.7.4.8","2.7.4.9","3.6.1","3.6.10","3.6.11","3.6.12","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9","3.9.1","3.9.10","3.9.11","3.9.12","3.9.13","3.9.14","3.9.2","3.9.3","3.9.4","3.9.5","3.9.6","3.9.7","3.9.8","3.9.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8032.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/uaa-release","events":[{"introduced":"0"},{"last_affected":"5147756aaa0e23c0fac49ad8b300245171b3ab86"},{"introduced":"9e9bc18c684b92f99e5ff97b857729ebb657f993"},{"last_affected":"3371c54ebf9473487e32fdf5e831ae21d8df3246"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"40"},{"introduced":"13.1"},{"last_affected":"13.1"},{"introduced":"13.2"},{"last_affected":"13.2"},{"introduced":"13.3"},{"last_affected":"13.3"},{"introduced":"13.4"},{"last_affected":"13.4"},{"introduced":"13.5"},{"last_affected":"13.5"},{"introduced":"13.6"},{"last_affected":"13.6"},{"introduced":"13.7"},{"last_affected":"13.7"},{"introduced":"13.8"},{"last_affected":"13.8"},{"introduced":"13.9"},{"last_affected":"13.9"},{"introduced":"13.10"},{"last_affected":"13.10"},{"introduced":"13.11"},{"last_affected":"13.11"},{"introduced":"13.12"},{"last_affected":"13.12"},{"introduced":"13.13"},{"last_affected":"13.13"},{"introduced":"13.14"},{"last_affected":"13.14"},{"introduced":"13.15"},{"last_affected":"13.15"},{"introduced":"13.16"},{"last_affected":"13.16"},{"introduced":"24"},{"last_affected":"24"},{"introduced":"24.1"},{"last_affected":"24.1"},{"introduced":"24.2"},{"last_affected":"24.2"},{"introduced":"24.3"},{"last_affected":"24.3"},{"introduced":"24.4"},{"last_affected":"24.4"},{"introduced":"24.5"},{"last_affected":"24.5"},{"introduced":"24.6"},{"last_affected":"24.6"},{"introduced":"24.7"},{"last_affected":"24.7"},{"introduced":"24.8"},{"last_affected":"24.8"},{"introduced":"24.9"},{"last_affected":"24.9"},{"introduced":"24.10"},{"last_affected":"24.10"},{"introduced":"24.11"},{"last_affected":"24.11"},{"introduced":"30"},{"last_affected":"30"},{"introduced":"30.1"},{"last_affected":"30.1"},{"introduced":"30.2"},{"last_affected":"30.2"},{"introduced":"30.3"},{"last_affected":"30.3"},{"introduced":"30.4"},{"last_affected":"30.4"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.12:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.13:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.14:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.15:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.16:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.7:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.8:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.9:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.10:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.11:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.2:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.3:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.4:*:*:*:*:*:*:*"]}}],"versions":["13.1","13.10","13.11","13.12","13.13","13.14","13.15","13.16","13.2","13.3","13.4","13.5","13.6","13.7","24","24.1","24.10","24.11","24.2","24.3","24.4","24.5","24.6","24.7","24.8","24.9","30","30.1","30.2","30.3","30.4","v30.4","v40","v39","v30.3","v30.2","v30.1","v30","v31","v27","v26","v24","v25","v23","v22","v21","v20","v19","v18","v17","v16","v15","v14","v12.3","ci-upgrade","v12","v11","v10","v9","v8","v7","v6","v3","v2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8032.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}