CVE-2019-3785 — Cloud Controller provides signed URL with write authorization to read only user
Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can reques…
Published: 2019-03-13 · CVSS: 6.5 · CVSS 3.0
Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7