CVE-2018-15755
Last modified
CVE-2018-15755 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.. EPSS estimates a 1.28% chance of exploitation in the next 30 days.
Description
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.
Metrics
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry | Cf-Networking | >= 2.11.0, < 2.16.0 |
References
- https://www.cloudfoundry.org/blog/cve-2018-15755/Third Party Advisory
- https://www.cloudfoundry.org/blog/cve-2018-15755/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-15755?
How severe is CVE-2018-15755?
How do I fix CVE-2018-15755?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-15749The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R…
- CVE-2018-15750Directory Traversal vulnerability in salt-api in SaltStack S…
- CVE-2018-15751SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 …
- CVE-2018-15752An issue was discovered in the MensaMax (aka com.breustedt.m…
- CVE-2018-15753An issue was discovered in the MensaMax (aka com.breustedt.m…
- CVE-2018-15754Cloud Foundry UAA, versions 60 prior to 66.0, contain an aut…4.2
- CVE-2018-15756Spring Framework, version 5.1, versions 5.0.x prior to 5.0.1…7.5
- CVE-2018-15757Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15758Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 …9.6
- CVE-2018-15759Pivotal Cloud Foundry On Demand Services SDK, versions prior…9.1
- CVE-2018-15760Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15761Cloud Foundry UAA release, versions prior to v64.0, and UAA,…9.9
Are you affected by CVE-2018-15755?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST