CVE-2021-22101
published 2021-10-27CVE-2021-22101: Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.97%
57.6th percentile
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudfoundry | capi-release | < 1.118.0 | 1.118.0 |
| cloudfoundry | cf-deployment | < 16.24.0 | 16.24.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cjhg-rj52-r938: Cloud Controller versions prior to 1
ghsa_unreviewed·2022-05-24
CVE-2021-22101 [HIGH] CWE-400 GHSA-cjhg-rj52-r938: Cloud Controller versions prior to 1
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
VMware
VMware Tanzu Application Service for VMs updates address a denial-of-service vulnerability (CVE-2021-22101)
vendor_vmware·2021-11-11·CVSS 7.5
CVE-2021-22101 [HIGH] VMware Tanzu Application Service for VMs updates address a denial-of-service vulnerability (CVE-2021-22101)
VMSA-2021-0026: VMware Tanzu Application Service for VMs updates address a denial-of-service vulnerability (CVE-2021-22101)
VMware Tanzu Application Service for VMs uses Cloud Controller (CAPI) from Cloud Foundry which is vulnerable to an unauthenticated denial-of-service(DoS) vulnerability. VMware has evaluated this issue to be 'Important' severity with a maximum CVSSv3 base score of 7.5.
CVEs: CVE-2021-22101
Affected products: VMware Tanzu
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-10-27
Published