CVE Feed

    Dashboard / CVE / CVE-2021-22100

    CVE-2021-22100

    In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to timeout and fail is possible. An attacker can leverage this vulnerability to cause an inability for anyone to push or manage apps.

    Published:Mar 25, 2022
    Last Modified:Nov 21, 2024
    EPS:Mar 25, 2022
    EPSS Score:0.00522
    CVSS Score:5.3

    Affected Products

    Vendor
    Cloudfoundry
    Product
    Capi-release
    Vendor
    Cloudfoundry
    Product
    Cf-deployment

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-20881 (CVSS 8.1) — Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may ove…
    CVE-2021-22101 (CVSS 7.5) — Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerabil…
    CVE-2021-22115 (CVSS 6.5) — Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logg…
    CVE-2020-5423 (CVSS 7.5) — CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an una…
    CVE-2020-5418 (CVSS 4.3) — Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "clou…
    CVE-2020-5417 (CVSS 8.8) — Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain…
    CVE-2020-5400 (CVSS 6.5) — Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they …
    CVE-2019-11294 (CVSS 4.3) — Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service …
    CVE-2019-3798 (CVSS 6) — Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when va…
    CVE-2019-3785 (CVSS 8.1) — Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High