medium6.6
CVE-2018-15755
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the …
Impact
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cloud Foundry | Cf-Networking | from 2.11.0 before 2.16.0 |