Cf Deployment
Approved changes feed: RSS · Atom
cpe:2.3:a:cloud_foundry:cf_deployment:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cloud Foundry (bbc462c7-a964-5178-97e1-18033ab4dbd3) |
|---|---|
| Product | Cf Deployment (6eb3d0d0-56e5-5a16-b1df-7ae62041d344) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59385 |
vulnerable | 2026-11-03 10:15:34.386860 |
Space Developer can extract space-scoped broker credentials
LOW (2.7)
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
Published: 2026-10-30T08:44:45.681Z
Updated: 2026-10-30T16:55:29.935Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41005 |
vulnerable | 2026-07-29 00:49:30.842741 |
UAA accepts SAML Encrypted Assertions authentication bypass
CRITICAL (9)
Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (ACS) when wantAssertionSigned is set to false. Assertions or responses that were unsigned but contained encrypted content could still be accepted. Encryption uses the SP's public key from published metadata, therefore, any party, not only a trusted IdP, can produce ciphertext UAA can decrypt; successful decryption therefore does not prove the IdP issued the message.
Affected versions:
Cloud Foundry UAA (uaa_release) 2.0.0 through 78.13.0.
Cloud Foundry CF Deployment all versions through 56.1.0.
Published: 2026-06-11T20:03:22.525Z
Updated: 2026-06-13T03:55:30.398Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22246 |
vulnerable | 2026-06-08 07:10:52.530157 |
CVE-2025-22246 – UAA Private Key Exposure
LOW (3)
Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
Published: 2025-05-13T05:14:40.968Z
Updated: 2025-05-13T13:49:09.193Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34061 |
vulnerable | 2026-06-08 06:06:24.357977 |
CVE-2023-34061 – Gorouter route pruning
HIGH (7.5)
Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.
Published: 2024-01-12T07:01:49.532Z
Updated: 2025-06-03T14:05:36.784Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34041 |
vulnerable | 2026-06-08 06:06:24.264640 |
CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter
MEDIUM (5.3)
Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.
Published: 2023-09-08T07:22:00.607Z
Updated: 2024-08-02T15:54:14.253Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5423 |
vulnerable | 2026-06-08 05:26:42.880655 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5420 |
vulnerable | 2026-06-08 05:26:42.829988 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5418 |
vulnerable | 2026-06-08 05:26:42.824435 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5417 |
vulnerable | 2026-06-08 05:26:42.821531 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5416 |
vulnerable | 2026-06-08 05:26:42.819923 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11283 |
vulnerable | 2026-06-08 05:12:36.807120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11282 |
vulnerable | 2026-06-08 05:12:36.805519 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11277 |
vulnerable | 2026-06-08 05:12:36.792582 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.