Products
Cloud Foundry
- before v40.17.0
Source
security@vmware.com
Tags
CVE-2024-37082 details
Published : July 3, 2024, 6:15 a.m.
Last Modified : July 3, 2024, 12:53 p.m.
Last Modified : July 3, 2024, 12:53 p.m.
Description
Security check loophole in HAProxy release (in combination with routing release) in Cloud Foundry prior to v40.17.0 potentially allows bypass of mTLS authentication to applications hosted on Cloud Foundry.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9.0 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
9.0
Exploitability Score
2.2
Impact Score
6.0
Base Severity
CRITICAL
Vector String : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://www.cloudfoundry.org/blog/cve-2024-37082-mtls-bypass/ | security@vmware.com |
This website uses the NVD API, but is not approved or certified by it.