CVEvulnerability

CVE-2018-1221

8.1 HIGH Published 2018-03-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-03-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:P
Weaknesses
CWE-20

Description

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service.

Affected configurations

• cloudfoundry cf-deployment (< 1.14.0) • cloudfoundry routing-release (< 0.172.0)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References