CVE-2019-11289

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

Score

CVSS 3.1 8.6 High

Status

Modified - security@pivotal.io

Published

2019-11-19

Last modified

2024-09-16

Weaknesses

CWE-20

Affected products

• Routing (Cloud Foundry)
• Cf-deployment (Cloudfoundry)
• Routing-release (Cloudfoundry)

References

• https://www.cloudfoundry.org/blog/cve-2019-11289