CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter
CVE-2023-34041

5.3MEDIUM

Key Information:

Vendor: Cloud Foundry
Status: Routing; CF Deployment
Vendor: CVE Published:; 8 September 2023

🔔 Create Cloud Foundry Vulnerability Alert

What is CVE-2023-34041?

Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.

Affected Version(s)

CF Deployment Windows all < 32.4.0

Routing Windows all < 0.278.0

References

https://www.cloudfoundry.org/blog/abuse-of-http-hop-by-ho...

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 8, 2023
Vulnerability Reserved
May 25, 2023

CVE-2023-34041 Data

JSON