VIR Vulnerability Intelligence Relay

CVE-2016-8218

critical
Published 2017-06-13 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
9.8

Description

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
cloudfoundrycf-release{"endIncluding":"203"}
cloudfoundrycf-release204
cloudfoundrycf-release205
cloudfoundrycf-release206
cloudfoundrycf-release207
cloudfoundrycf-release208
cloudfoundrycf-release209
cloudfoundrycf-release210
cloudfoundrycf-release211
cloudfoundrycf-release212
cloudfoundrycf-release213
cloudfoundrycf-release214
cloudfoundrycf-release215
cloudfoundrycf-release217
cloudfoundrycf-release218
cloudfoundrycf-release219
cloudfoundrycf-release220
cloudfoundrycf-release221
cloudfoundrycf-release222
cloudfoundrycf-release223
cloudfoundrycf-release224
cloudfoundrycf-release225
cloudfoundrycf-release226
cloudfoundrycf-release227
cloudfoundrycf-release228
cloudfoundrycf-release229
cloudfoundrycf-release230
cloudfoundrycf-release231
cloudfoundryrouting-release{"endIncluding":"0.141.0"}

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.