Cf Deployment (Cloud Foundry) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-06-11. Vendor: Cloud Foundry.
CVEs of Cf Deployment
- CVE-2026-41005 - CVSS 9 (critical), 2026-06-11: Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider…
- CVE-2025-22246 - CVSS 7.5 (high), 2025-05-13: Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
- CVE-2023-34061 - CVSS 7.5 (high), 2024-01-12: Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to…
- CVE-2023-34041 - CVSS 5.3 (medium), 2023-09-08: Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this…
- CVE-2020-5423 - CVSS 7.5 (high), 2020-12-02: CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send…
- CVE-2020-5418 - CVSS 4.3 (medium), 2020-09-03: Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any…
- CVE-2020-5420 - CVSS 7.7 (high), 2020-09-03: Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by…
- CVE-2020-5417 - CVSS 8.8 (high), 2020-08-21: Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the…
- CVE-2020-5416 - CVSS 7.7 (high), 2020-08-21: Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially…
- CVE-2019-11283 - CVSS 8.8 (high), 2019-10-23: Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs…
- CVE-2019-11282 - CVSS 4.3 (medium), 2019-10-23: Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with…
- CVE-2019-11277 - CVSS 8.4 (high), 2019-09-23: Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated…
