SQL Injection Vulnerability in Cloud Foundry CF Networking Release

CVE-2018-15755 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:P/A:P

Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.