CF
Product
Cf-deployment
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 18Medium 17Low 0
Watch
Add Cf-deployment to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5417 | 8.8 | Aug 21 | Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF… Affected: before 13.12.0 |
| CVE-2020-5402 | 8.8 | Feb 27 | In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with… Affected: before 12.33.0 |
| CVE-2019-11283 | 8.8 | Oct 23 | Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs Affected: before 12.2.0 |
| CVE-2018-1191 | 8.8 | Mar 29 | Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability Affected: before 1.9.0 |
| CVE-2018-1195 | 8.8 | Mar 19 | In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for… Affected: before 1.3.0 |
| CVE-2019-11289 | 8.6 | Nov 19 | Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input Affected: before 12.8.0 |
| CVE-2023-20881 | 8.1 | May 19 | Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the… Affected: 24.7.0 through 29.0.0 |
| CVE-2019-11277 | 8.1 | Sep 23 | Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection Affected: before 11.1.0 |
| CVE-2018-1221 | 8.1 | Mar 19 | In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some… Affected: before 1.14.0 |
| CVE-2020-5420 | 7.7 | Sep 3 | Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that… Affected: before 13.15.0 |
| CVE-2025-22246 | 7.5 | May 13 | CVE-2025-22246 – UAA Private Key Exposure Affected: 45.1.0 before 49.0.0 |
| CVE-2024-22279 | 7.5 | Jun 10 | GoRouter Denial of Service Attack Affected: 30.9.0 through 40.13.0 |
| CVE-2021-22101 | 7.5 | Oct 27 | Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by… Affected: before 16.24.0 |
| CVE-2021-22001 | 7.5 | Jul 22 | In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type… Affected: before 16.18.0 |
| CVE-2020-5423 | 7.5 | Dec 2 | CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files… Affected: before 15.0.0 |
| CVE-2019-11290 | 7.5 | Nov 26 | Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file Affected: before 12.10.0 |
| CVE-2018-1265 | 7.2 | Jun 6 | Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers Affected: before 1.37.0 |
| CVE-2018-1262 | 7.2 | May 15 | Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline… Affected: 1.27.0 through 1.31.0 |
Showing 18