SB2019042417 - Permissions, Privileges, and Access Controls in Routing Release

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019042417

SB2019042417 - Permissions, Privileges, and Access Controls in Routing Release

Published: April 24, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019042417
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-3789)

The vulnerability allows a remote authenticated user to manipulate data.

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.


Remediation

Install update from vendor's website.

References