N/A

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

N/A

N/A

Cloud Controller、cf-deployment和cf-release 安全漏洞

Cloud Foundry是美国Cloud Foundry基金会的一套开源的平台即服务（PaaS）云计算平台，它提供容器调度、持续交付和自动化服务部署等功能。cf-release是CF的一个发布版本。cf-deployment是它的开发版本。Cloud Controller是一款云控制器。 Cloud Controller 1.46.0之前版本、cf-deployment 1.3.0之前版本和cf-release 283之前版本中存在安全漏洞。攻击者可借助刷新令牌利用该漏洞进行身份验证。

N/A

N/A