Lucene search

[email protected]CVE-2021-22101

HistoryOct 27, 2021 - 3:15 p.m.

CVE-2021-22101

2021-10-2715:15:07

CWE-400

[email protected]

web.nvd.nist.gov

cve-2021-22101

cloud controller

denial of service

dos

unauthenticated

vulnerability

rest

http requests

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

40.8%

JSON

Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.

Affected configurations

NVD

Node

cloudfoundrycapi-releaseRange<1.118.0

cloudfoundrycf-deploymentRange<16.24.0

CPENameOperatorVersion
cloudfoundry:capi-releasecloudfoundry capi-releaselt1.118.0
cloudfoundry:cf-deploymentcloudfoundry cf-deploymentlt16.24.0

CPE	Name	Operator	Version
cloudfoundry:capi-release	cloudfoundry capi-release	lt	1.118.0
cloudfoundry:cf-deployment	cloudfoundry cf-deployment	lt	16.24.0

CNA Affected

[
  {
    "product": "Cloud Foundry Cloud Controller",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cloud Foundry Cloud Controller versions prior to 1.118.0"
      }
    ]
  }
]