This vulnerability (CWE-297) in CloudFoundry Foundation UAA allows a network attacker in a man-in-the-middle position between UAA and its LDAP directory to impersonate the LDAP server by exploiting improper certificate validation with host mismatches. The attacker can use any certificate issued by a trusted CA to masquerade as the LDAP directory, intercept and harvest LDAP bind passwords and user passwords sent during simple-bind authentication over StartTLS, and return forged group memberships that grant administrative privileges. This affects all UAA deployments authenticating users against LDAP over StartTLS prior to version 78.13.0. The vulnerability has a CVSS 4.0 base score of 8.3 (high severity).

An attacker who can intercept network traffic between UAA and the LDAP directory can impersonate the LDAP server, harvest sensitive credentials including LDAP bind and end-user passwords, and escalate privileges by forging group memberships to gain admin scopes. This compromises authentication integrity and authorization controls in affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using LDAP over StartTLS for authentication or implement additional network-level protections to prevent man-in-the-middle attacks. Monitor vendor communications for updates and apply patches promptly once released.