CVE-2018-15755

Summary

Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.

Affected Software

VendorProductVersion RangeStatus
Cloud FoundryCF Networking Release2.11.0 < 2.16.0affected

Weaknesses

  • SQL Injection

ADP Enrichment

CVE Program Container

Additional References

References