title: CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter
description: Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.
affected:
{
defaultStatus: unaffected
platforms: [Windows, Linux, iOS, Android, x86, ARM, 64 bit, MacOS, 32 bit]
product: Routing
vendor: Cloud Foundry
versions:
lessThan: 0.278.0, status: affected, version: all, versionType: 0.278.0
}
{
defaultStatus: unaffected
platforms: [Windows, Linux, iOS, Android, x86, ARM, 64 bit, MacOS, 32 bit]
product: CF Deployment
vendor: Cloud Foundry
versions:
lessThan: 32.4.0, status: affected, version: all, versionType: 32.4.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL