CVE-2018-1193: Medium severity Cloudfoundry Cf-deployment vulnerability
Published May 23, 2018
·Updated
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.
Affected Software
2 affected components
Cloudfoundry Cf-deployment<1.27.0
Cloudfoundry Routing-release<0.175.0
Event History
May 23, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1193.
2
What is the title of the vulnerability?
The title of the vulnerability is 'Cloud Foundry routing-release versions prior to 0.175.0 lacks sanitization for user-provided X-Forwarded-Proto headers'.
3
How does this vulnerability affect Cloud Foundry routing-release?
The vulnerability affects Cloud Foundry routing-release versions prior to 0.175.0.
4
What is the severity of CVE-2018-1193?
The severity of CVE-2018-1193 is medium (5.3).
5
How can I fix this vulnerability?
To fix this vulnerability, update your Cloud Foundry routing-release to version 0.175.0 or later.