CVE-2018-1221

    Dashboard / Vulnerabilities / CVE-2018-1221

    CVE-2018-1221

    Published: 19 Mar 2018Last Modified: 8 Jul 2026

    Summary:

    Details: In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service.

    References: https://www.cloudfoundry.org/blog/cve-2018-1221/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -20e949909c1136753f4b43e532c04c3cf02f64ac

    Affected versions

    v1.13.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High