CVE-2018-15755

MEDIUM

Cloud Foundry CF Networking 2.11.0-2.15.x - Authenticated SQL Injection via Internal API Endpoint

Title source: llm
STIX 2.1

Description

Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_confirm
https://www.cloudfoundry.org/blog/cve-2018-15755/

Scores

CVSS v3 6.6
EPSS 0.0128
EPSS Percentile 67.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
cloud_foundry/cf-networking 2.11.0 - 2.16.0
Published Oct 12, 2018
Tracked Since Feb 18, 2026