Pivotal Single Sign-On for PCF CVE-2017-8040 XML External Entity Injection Vulnerability

Bugtraq ID:	100617
Class:	Unknown
CVE:	CVE-2017-8040
Remote:	Yes
Local:	No
Published:	Aug 31 2017 12:00AM
Updated:	Aug 31 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Pivotal Single Sign-On for PCF 1.4.2 Pivotal Single Sign-On for PCF 1.4 Pivotal Single Sign-On for PCF 1.3.3 Pivotal Single Sign-On for PCF 1.3
Not Vulnerable:	Pivotal Single Sign-On for PCF 1.4.3 Pivotal Single Sign-On for PCF 1.3.4

Pivotal Single Sign-On for PCF CVE-2017-8040 XML External Entity Injection Vulnerability

Pivotal Single Sign-On for PCF is prone to an XML External Entity injection vulnerability.

Attackers can exploit this issue to gain access to sensitive information or cause denial-of-service conditions.

The following products are affected:

Single Sign-On for PCF 1.3.x versions prior to 1.3.4.
Single Sign-On for PCF 1.4.x versions prior to 1.4.3.

Pivotal Single Sign-On for PCF CVE-2017-8040 XML External Entity Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pivotal Single Sign-On for PCF CVE-2017-8040 XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pivotal Single Sign-On for PCF CVE-2017-8040 XML External Entity Injection Vulnerability

References:

• Pivotal Homepage (Pivotal)
  
• Single Sign-On for PCF Homepage (Pivotal)
  
• CVE-2017-8040: XXE Vulnerability in Single Sign-On for PCF (Pivotal)