CVE-2016-2169

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-18 · updated 2026-06-17
Weakness: CWE-17

Description

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service.

Affected products

Cloud Foundry CAPI: before 1.0.0 — fixed in 1.0.0
Cloud Foundry Cloud Controller cf-release versions prior to v255: before 237 — fixed in 237

How to fix

Upgrade to a fixed version: Cloud Foundry CAPI 1.0.0; Cloud Foundry Cloud Controller cf-release versions prior to v255 237. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-2169 or the next vulnerability affects your stack