CloudFoundry Foundation

Records118All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high64CVSS 7.0–8.9

Exploited now

CloudFoundry Foundation records in CISA KEV

No CloudFoundry Foundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cf-deployment 37 records MEDIUM Cf-release 35 records MEDIUM Capi-release 22 records MEDIUM Cloud Foundry Uaa Bosh 15 records MEDIUM User Account And Authentication 9 records MEDIUM Routing-release 8 records MEDIUM Routing Release 5 records LOW Uaa Release 5 records MEDIUM

Records

8 records in Routing-release · all components

TI-2016-06771 CVE-2016-8218 · GHSA-vc7q-m69g-gmvq

Improper input validation in Cloud Foundry

MEDIUM 45

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01297 Published 2017-06-13 No fix listed CWE-20

TI-2019-08446 CVE-2019-11289 · GHSA-5796-p3m6-9qj4

A forged route service request using an invalid nonce can cause the gorouter to panic and crash

MEDIUM 40

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0151 Published 2019-11-19 Fixed in 0.193.0, 0.0.0-20191101214924-b1b5c44e050f CWE-20

TI-2018-01132 CVE-2018-1221

Improper input validation in Dell EMC The Cloud Foundry Gorouter

LOW 38

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01208 Published 2018-03-19 No fix listed CWE-20

TI-2020-12262 CVE-2020-15586 · GHSA-9rmg-8r3f-xrq7

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as…

LOW 32

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02883 Published 2020-07-17 Partial fix CWE-362

TI-2020-04462 CVE-2020-5416

CF clusters with NGINX in front of them may be vulnerable to DoS

LOW 31

Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthentica…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01245 Published 2020-08-21 Fixed in 0.204.0, 13.13.0 CWE-404

TI-2017-05627 CVE-2017-8034 · GHSA-47fq-mm42-6v8w

The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to…

LOW 31

The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens…

CVSS 3.0MEDIUM 6.6 Network High privileges No interaction EPSS 0.00751 Published 2017-07-17 No fix listed CWE-565

TI-2018-01108 CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for…

LOW 26

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01091 Published 2018-05-23 Fixed in 0.175.0

TI-2023-16907 CVE-2023-34041 · GHSA-9jjv-6rgq-8j87

CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter

LOW 24

Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00436 Published 2023-09-08 Fixed in 0.278.0, 32.4.0

Open these records in search →