CVE-2024-37082

published 2024-07-03

CVE-2024-37082: When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that…

Priority P2 60 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications.

You are affected if you have route-services enabled in routing-release and have configured the haproxy-boshrelease property “ha_proxy.forwarded_client_cert” to “forward_only_if_route_service”.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cloud_foundry	haproxy-boshrelease	< 0.299.0	0.299.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-290