CVE-2018-1193 Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially...
MediumCVSS 5.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-deployment | < 1.27.0 | 1.27.0 |
| cloudfoundry routing-release | < 0.175.0 | 0.175.0 |
| Cloud Foundry Router | = versions prior to 0.175.0 | No fix listed |
References
- www.cloudfoundry.org vendor-advisory