CVE-2019-11289highCWE-20

CVE-2019-11289: falha de alta gravidade em Cloud Foundry Routing

A forged route service request using an invalid nonce can cause the gorouter to panic and crash

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Routing+ Monitorar code.cloudfoundry.org/gorouter

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 1.5%
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Produtos afetados
Cloud Foundry · Routing
CVEs relacionadas — Cloud Foundry Routing

No mesmo produto, das mais perigosas para as menos.

CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2020-5401MEDIUMCloud Foundry GoRouter is vulnerable to cache poisoningEPSS 1.0%CVE-2023-34041MEDIUMCVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry GorouterEPSS 0.4%