Cf Deployment
Vendor:
First CVE: Nov 28, 2017 · Active for 8 years
37
Total CVEs
More Total CVEs than 97% of tracked products
3.7
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 42% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Cf Deployment over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 28, 2017
8 years ago
Most Recent CVE
May 1, 2026
84 days ago
CVE Severity & Scoring
Cf Deployment37 CVEs
46%
49%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network37 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low35 (94.6%)
High2 (5.4%)
Unknown0 (0.0%)
User Interaction
None35 (94.6%)
Unknown0 (0.0%)
Required2 (5.4%)
Privileges Required
Low19 (51.4%)
High2 (5.4%)
None16 (43.2%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (37 CVEs).
37 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-3801CRITICAL Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated mali | Apr 25, 2019 | 9.8 | 31 | NO | NO |
CVE-2022-31733CRITICAL Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing applicatio | Feb 3, 2023 | 9.1 | 29 | NO | NO |
CVE-2018-1195HIGH In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authenticatio | Mar 19, 2018 | 8.8 | 29 | NO | NO |
CVE-2020-5417HIGH Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment | Aug 21, 2020 | 8.8 | 27 | NO | NO |
CVE-2019-11289HIGH Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using | Nov 19, 2019 | 8.6 | 27 | NO | NO |
CVE-2018-1191HIGH Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and | Mar 29, 2018 | 8.8 | 27 | NO | NO |
CVE-2023-20881HIGH Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the cli | May 19, 2023 | 8.1 | 25 | NO | NO |
CVE-2019-11283HIGH Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the userna | Oct 23, 2019 | 8.8 | 25 | NO | NO |
CVE-2019-11277HIGH Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer | Sep 23, 2019 | 8.1 | 25 | NO | NO |
CVE-2026-22726MEDIUM Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoun | May 1, 2026 | 5.0 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (37 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (37 CVEs).
Media Mentions
Signals from CVEs in this product scope (37 CVEs).
Top CNAs Publishing CVEs For Cf Deployment
Top CWEs
Versions
No cataloged versions.