VMware Single Sign-On For Pivotal Cloud Foundry vulnerabilities

3 CVEs affecting VMware Single Sign-On For Pivotal Cloud Foundry, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-8044, published 2017-11-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-8040, published 2017-09-09. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service…
CVE-2017-8044, published 2017-11-27. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading…
CVE-2017-8041, published 2017-09-09. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by…