CVE-2019-11277
High
Description
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.
SeverityHigh
CVSS8.1
Exploit probability77. percentile1.7%
ProductCloudfoundry Cf-deployment
PublishedSep 23, 2019
First seenSep 23, 2019
Weakness typeCWE-90CWE-90
How to fix
Update
- cloudfoundry cf-deployment11.1.0 or later
- cloudfoundry nfs_volume_release1.7.11, 2.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-deployment | v < 11.1.0 | 11.1.0 |
| cloudfoundry nfs_volume_release | 1.7.0 ≤ v < 1.7.11, 2.0.0 ≤ v < 2.3.0 | 1.7.11, 2.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.