Vulnerability Details CVE-2018-15755
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 68.0%
CVSS Severity
CVSS v3 Score 6.6
CVSS v2 Score 6.5
References
Products affected by CVE-2018-15755
-
cpe:2.3:a:cloud_foundry:cf-networking:2.11.0
-
cpe:2.3:a:cloud_foundry:cf-networking:2.12.0
-
cpe:2.3:a:cloud_foundry:cf-networking:2.13.0
-
cpe:2.3:a:cloud_foundry:cf-networking:2.14.0
-
cpe:2.3:a:cloud_foundry:cf-networking:2.15.0
-
cpe:2.3:a:cloud_foundry:cf-networking:2.15.1