Cloudfoundry Cf-Deployment vulnerabilities

CVE-2020-5420 [HIGH] CWE-754 CVE-2020-5420: Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.

CVE-2021-22115 [MEDIUM] CWE-522 CVE-2021-22115: Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller.

CVE-2020-5400 [MEDIUM] CWE-522 CVE-2020-5400: Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.

CVE-2020-5416 [MEDIUM] CWE-404 CVE-2020-5416: Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX re Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause the Gorouters to be dropped from the NGINX backend poo

CVE-2020-15586 [MEDIUM] CWE-362 CVE-2020-15586: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVE-2026-22723 [MEDIUM] CWE-640 CVE-2026-22723: Inappropriate user token revocation due to a logic error in the token revocation endpoint implementa Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.

CVE-2017-14389 [MEDIUM] CVE-2017-14389: An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf- An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space,

CVE-2018-1277 [MEDIUM] CWE-400 CVE-2018-1277: Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Dock Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious Docker image that will consume more space on a Diego cell than allocated in their quota, potentially causing a DoS against the cell.

CVE-2023-34041 [MEDIUM] CVE-2023-34041: Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop H Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.

CVE-2026-22726 [MEDIUM] CWE-923 CVE-2026-22726: Route Services can be leveraged to send app traffic to network destinations outside of an app's conf Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had

CVE-2023-20882 [MEDIUM] CWE-400 CVE-2023-20882: In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter pr In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.

CVE-2018-1193 [MEDIUM] CVE-2018-1193: Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-For Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.

CVE-2021-22098 [MEDIUM] CWE-601 CVE-2021-22098: UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious us UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims’ accounts in certain cases along with redirection of UAA users to a malicious sites.

CVE-2021-22100 [MEDIUM] CWE-400 CVE-2021-22100: In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can p In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to timeout and fail is possible. An attacker can leverage this vulnerability to cause an inability for anyone to push or manage apps.

CVE-2019-11282 [MEDIUM] CWE-200 CVE-2019-11282: Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM inject Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.

CVE-2019-11294 [MEDIUM] CWE-200 CVE-2019-11294: Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all globa Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.

CVE-2020-5418 [MEDIUM] CWE-863 CVE-2020-5418: Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).