CVE-2020-5401 - Cloud Foundry GoRouter is vulnerable to cache poisoning

Back Back to CVE browser

MEDIUM

Cloud Foundry GoRouter is vulnerable to cache poisoning

Published Feb 27, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 1.04%

Description

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.

Affected products

Vendor Cloud Foundry Product Routing Default
unknown
Affected
- ≥ unspecified, < 0.197.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Cloud Foundry	Routing	unknown	Affected ≥ unspecified, < 0.197.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-393

CWE-444

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26580
Advisory
https://www.cloudfoundry.org/blog/cve-2020-5401
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26580		Advisory
https://www.cloudfoundry.org/blog/cve-2020-5401		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner pivotal

Published Feb 27, 2020

Updated Sep 16, 2024

Reserved Jan 3, 2020

Link CVE-2020-5401

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-5401

Red Hat

No data

ENISA EUVD

Assigner pivotal

Published Feb 27, 2020

Updated Sep 16, 2024

Link EUVD-2020-26580

GitHub

No data