CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: cloud foundry cf networking release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to sql injection between diego cells and the policy server. a remote authenticated malicious user with mtls certs can issue arbitrary sql queries and gain access to the policy server.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-10-12
Last Modified Date: 2019-10-09