CVE-2019-11277 Information

Description

Cloud Foundry NFS Volume Service 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0 is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation facilitating the malicious space developer to deny service or perform a dictionary attack.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Reference

https://www.cloudfoundry.org/blog/cve-2019-11277

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

HIGH

Base Severity

8.1