Vulnerabilities > Cloudfoundry

DATE CVE VULNERABILITY TITLE RISK
2022-03-25 CVE-2021-22100 Resource Exhaustion vulnerability in Cloudfoundry Capi-Release
In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to timeout and fail is possible.
network
low complexity
cloudfoundry CWE-400
5.0
2021-10-27 CVE-2021-22101 Resource Exhaustion vulnerability in Cloudfoundry Capi-Release
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
network
low complexity
cloudfoundry CWE-400
5.0
2021-07-22 CVE-2021-22001 Unspecified vulnerability in Cloudfoundry Cf-Deployment
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
network
low complexity
cloudfoundry
5.0
2021-04-08 CVE-2021-22115 Insufficiently Protected Credentials vulnerability in Cloudfoundry Capi-Release
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed.
network
low complexity
cloudfoundry CWE-522
4.0
2020-12-02 CVE-2020-5423 Resource Exhaustion vulnerability in Cloudfoundry Capi-Release
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
network
low complexity
cloudfoundry CWE-400
7.8
2020-09-03 CVE-2020-5420 Improper Check for Unusual or Exceptional Conditions vulnerability in Cloudfoundry Cf-Deployment
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.
network
low complexity
cloudfoundry CWE-754
6.8
2020-09-03 CVE-2020-5418 Incorrect Authorization vulnerability in Cloudfoundry Capi-Release
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
network
low complexity
cloudfoundry CWE-863
4.0
2020-08-21 CVE-2020-5417 Incorrect Permission Assignment for Critical Resource vulnerability in Cloudfoundry Cf-Deployment
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
network
low complexity
cloudfoundry CWE-732
6.5
2020-08-21 CVE-2020-5416 Improper Resource Shutdown or Release vulnerability in Cloudfoundry Cf-Deployment
Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause the Gorouters to be dropped from the NGINX backend pool.
network
low complexity
cloudfoundry CWE-404
4.0
2020-07-17 CVE-2020-15586 Race Condition vulnerability in multiple products
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
4.3