CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 4.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: an issue was discovered in cloud foundry foundation cf-release versions prior to v258; uaa release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and uaa bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. an authorized user can use a blind sql injection attack to query the contents of the uaa database, aka "blind sql injection with privileged uaa endpoints."
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2017-06-13
Last Modified Date: 2017-06-27