code.cloudfoundry.org vulnerabilities

Products

• code.cloudfoundry.org/archiver 1
• code.cloudfoundry.org/gorouter 1

Latest code.cloudfoundry.org CVEs

Newest publication first

1. CVE-2019-11289 Cloud Foundry Routing Improper Input Validation vulnerability

   Published 2019-11-19

   High·CVSS 8.6

   Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

2. CVE-2018-25046 Cloud Foundry Archiver vulnerable to path traversal

   Critical·CVSS 9.1 EPSS 1.3%

   Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.