« Volver al listado

CVE-2018-1221

Estado: ModificadaAlta (8.1)—

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cloudfoundry — Cf-deploymentCloudfoundry — Routing-release

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1221",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell EMC",
          "product": "The Cloud Foundry Gorouter",
          "versions": [
            {
              "status": "affected",
              "version": "cf-deployment - All versions prior to 1.14.0"
            },
            {
              "status": "affected",
              "version": "routing-release - All versions prior to 0.172.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-19T18:29:00.547",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2018-1221/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2018-1221/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service."
    },
    {
      "lang": "es",
      "value": "En cf-deployment en versiones anteriores a la 1.14.0 y routing-release en versiones anteriores a la 0.172.0, Cloud Foundry Gorouter gestiona de manera incorrecta las peticiones WebSocket para AWS Application Load Balancers (ALBs) y otros HTTP-aware Load Balancers. Un usuario con privilegios de desarrollador podría emplear esta vulnerabilidad para robar datos o provocar una denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-06-17T01:50:45.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D24E8B91-2533-4F6D-9D48-1EF7F025030E",
              "versionEndExcluding": "1.14.0"
            },
            {
              "criteria": "cpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49E1AFBF-F369-4E9C-A77C-A772F77A3D93",
              "versionEndExcluding": "0.172.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}