Security readout for executives and security teams
Plain-English summary
This flaw lets a Cloud Foundry space developer redirect traffic meant for an external route service to an app they control inside the platform. That can expose or alter sensitive traffic and disrupt service behavior. The vulnerable component is CF Routing/Gorouter before version 0.188.0.
Executive priority
Treat as high priority for Cloud Foundry platforms using external route services. The risk is post-authenticated but business-impacting because a developer-level user could redirect sensitive service traffic.
Technical view
CF Routing Release before 0.188.0 allowed private domains to shadow external route-service domains. A space developer could map the shadow route to an app, causing Gorouter traffic for the external route service to be delivered internally instead. CVSS 3.0 is 8.8 high, with confidentiality, integrity, and availability impact.
Likely exposure
Cloud Foundry environments running CF Routing before 0.188.0 are most exposed when they use route services hosted outside the platform and grant space developer permissions broadly.
Exploitation context
The bundle does not show known active exploitation or CISA KEV listing. Exploitation requires authenticated space developer permissions, then abuse of domain and route mapping behavior to hijack route-service traffic.
Researcher notes
The issue is classified as CWE-840 and is a routing/business-logic validation failure. Evidence is limited to the CVE metadata and Cloud Foundry advisory reference; no exploit-in-the-wild claim is supported by the provided bundle.
Mitigation direction
- Upgrade CF Routing Release to 0.188.0 or later.
- Review the Cloud Foundry advisory before applying environment-specific controls.
- Restrict space developer permissions to trusted users only.
- Audit and remove private domains that shadow external route-service domains.
- Assess externally hosted route services for traffic hijack exposure.
Validation and detection
- Inventory CF Routing Release versions across Cloud Foundry foundations.
- Confirm no foundation is running CF Routing earlier than 0.188.0.
- Review private domains and route mappings for shadowing of external route-service domains.
- Audit users and groups with space developer permissions.
- Check change history for unexpected domain or route mapping changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-840: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-3789 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cloudfoundry.org/blog/cve-2019-3789CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Business Logic Errors
Business Logic Errors represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.