CVE-2019-11289CWE-20

A forged route service request using an invalid nonce can cause the gorouter to panic and crash

High · published November 19, 2019

CVSS v3.0
8.6
EPSS
2%
Percentile
74.2
In the wild
Unconfirmed
What it is

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

The record
Technical detail
CVSS v3.0
8.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01510 · 74.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2019-11-19T18:41Z
EPSS history
Timeline
  • 19 NOV 18:41Z
    A forged route service request using an invalid nonce can cause the gorouter to panic and crash
    cvelistv5