Description
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloud Foundry | CF NFS volume release | 1.7 – < v1.7.11, 2.3 – < v2.3.0 | v1.7.11 |
| Cloud Foundry | CF Deployment | All – < v11.1.0 | v11.1.0 |