CVE-2019-3789

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

0.77%

Published

Apr 24, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-840CWE-269

Affected Products (1)

cloudfoundry · routing_release (up to 0.188.0)vulnerable

References (2)

https://www.cloudfoundry.org/blog/cve-2019-3789

Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2019-3789

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs