CVE-2020-5401: medium-severity vulnerability in Cloud Foundry Routing
Cloud Foundry GoRouter is vulnerable to cache poisoning
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 1.0%
Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Cloud Foundry · RoutingRelated CVEs — Cloud Foundry Routing
In the same product, most dangerous first.
CVE-2019-11289HIGHA forged route service request using an invalid nonce can cause the gorouter to panic and crashEPSS 1.5%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2023-34041MEDIUMCVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry GorouterEPSS 0.4%