CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5401 – Cloud Foundry GoRouter is vulnerable to cache poisoning
https://notcve.org/view.php?id=CVE-2020-5401
Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. Cloud Foundry Routing Release, versiones anteriores a 0.197.0, contiene GoRouter, que permite a clientes maliciosos enviar encabezados no válidos, causando que las capas de almacenamiento caché rechacen a clientes legítimos posteriores que intentan acceder a la aplicación. • https://www.cloudfoundry.org/blog/cve-2020-5401 • CWE-393: Return of Wrong Status Code CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3789 – Gorouter allows space developer to hijack route services hosted outside the platform
https://notcve.org/view.php?id=CVE-2019-3789
Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route. Cloud Foundry Routing Release, todas las versiones anteriores a 0.188.0, contiene una vulnerabilidad que puede secuestrar el tráfico para enrutar los servicios alojados fuera de la plataforma. Un usuario con permisos de desarrollador de espacio puede crear un dominio privado que oculte el dominio externo del servicio de ruta y asignar esa ruta hacia una aplicación. • https://www.cloudfoundry.org/blog/cve-2019-3789 • CWE-269: Improper Privilege Management CWE-840: Business Logic Errors •