An issue exists in Cloud Foundry Foundation capi-release (all versions before 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cloudfoundry capi-release |
||
cloudfoundry cf-deployment |
||
cloudfoundry cf-release |
Vulmon