CVE-2019-11277

Volume Services is vulnerable to an LDAP injection attack

State: Published
Severity: 8.4 High
Published: Sep 23, 2019
Updated: Sep 16, 2024
Reserved: Apr 18, 2019

Description

Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.

Scores

CVSS	Score	Vector	Source
3.0	8.4 High	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L	pivotal

Weaknesses

CWE-90 LDAP Injection

Affected Products

Product	Versions
CF NFS volume releaseCloud Foundry	1.7 to before v1.7.11Affected 2.3 to before v2.3.0Affected
CF DeploymentCloud Foundry	All to before v11.1.0Affected

References

https://www.cloudfoundry.org/blog/cve-2019-11277

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.