This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-47840 | BDVDB-2026-346558 Detail

CloudFoundry FoundationUAA

Description#

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS. Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.

Impact#

LDAP directory impersonation via man-in-the-middle, leading to credential harvesting and forged group memberships granting admin scopes.

Weaknesses#

  • CWE-297 Improper Validation of Certificate with Host Mismatch

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.