CVE-2019-3789

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.

• CWE-840
• CWE-269

• https://www.cloudfoundry.org/blog/cve-2019-3789Vendor Advisory
• https://www.cloudfoundry.org/blog/cve-2019-3789Vendor Advisory

Published

Apr 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3783Cloud Foundry Stratos, versions prior to 2.3.0, deploys with…8.8
• CVE-2019-3784Cloud Foundry Stratos, versions prior to 2.3.0, contains an …8.2
• CVE-2019-3785Cloud Foundry Cloud Controller, versions prior to 1.78.0, co…8.1
• CVE-2019-3786Cloud Foundry BOSH Backup and Restore CLI, all versions prio…7.1
• CVE-2019-3787Cloud Foundry UAA, versions prior to 73.0.0, falls back to a…8.3
• CVE-2019-3788Cloud Foundry UAA Release, versions prior to 71.0, allows cl…8.7
• CVE-2019-3790The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3…6.1
• CVE-2019-3791Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-3792Pivotal Concourse version 5.0.0, contains an API that is vul…6.8
• CVE-2019-3793Pivotal Apps Manager Release, versions 665.0.x prior to 665.…9.8
• CVE-2019-3794Cloud Foundry UAA, versions prior to v73.4.0, does not set a…5.4
• CVE-2019-3795Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior …5.3