CVE-2021-22101 — Uncontrolled Resource Consumption in Capi-release

CWE-400 — Uncontrolled Resource Consumption4 documents4 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 23.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cloudfoundry Capi-releaseCloudfoundry Cf-deployment
Timeline
PublishedOct 27
Latest updateMay 24

Description

Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-cjhg-rj52-r938: Cloud Controller versions prior to 1↗2022-05-24
▶
CVEList
CVE-2021-22101: Cloud Controller versions prior to 1↗2021-10-27
▶

📋Vendor Advisories

1
VMware
VMware Tanzu Application Service for VMs updates address a denial-of-service vulnerability (CVE-2021-22101)↗2021-11-11
▶
CVE-2021-22101 — Uncontrolled Resource Consumption | cvebase