PT-2019-12224 · Cloud Foundry · Cloud Foundry Nfs Volume Service

Published 2019-09-23 · Updated 2019-10-09 · CVE-2019-11277

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Cloud Foundry NFS Volume Service versions 1.7.x prior to 1.7.11 Cloud Foundry NFS Volume Service versions 2.x prior to 2.3.0

Description The issue allows a remote authenticated malicious space developer to potentially inject LDAP filters via service instance creation. This could facilitate the malicious space developer to deny service or perform a dictionary attack.

Recommendations For versions 1.7.x prior to 1.7.11, update to version 1.7.11 or later. For versions 2.x prior to 2.3.0, update to version 2.3.0 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-90

Related Identifiers

CVE-2019-11277

Affected Products

Cloud Foundry Nfs Volume Service

References · 3

• https://osv.dev/vulnerability/CVE-2019-11277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11277 · Security Note
• https://cloudfoundry.org/blog/cve-2019-11277 · Vendor Advisory