CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.

Score

CVSS 3.0 5.3 Medium

Status

Modified - security_alert@emc.com

Published

2018-05-23

Last modified

2024-09-17

Affected products

• Cloud Foundry Router (Cloud Foundry)
• Cf-deployment (Cloudfoundry)
• Routing-release (Cloudfoundry)

References

• https://www.cloudfoundry.org/blog/cve-2018-1193/