This vulnerability (CWE-297) in CloudFoundry Foundation UAA allows a network attacker who can intercept traffic between UAA and its LDAP directory to impersonate the LDAP server by presenting any certificate issued by a trusted CA without proper hostname validation. This enables the attacker to capture sensitive credentials including the LDAP bind password and user passwords sent during simple-bind authentication over StartTLS. Additionally, the attacker can return forged group membership information to escalate privileges by granting themselves administrative scopes. The issue affects all UAA deployments authenticating users against LDAP over StartTLS in versions prior to 78.13.0 and cf-deployment versions prior to 56.2.0.

An attacker in a man-in-the-middle position can compromise LDAP authentication by harvesting credentials and escalating privileges to admin levels within UAA. This can lead to unauthorized access and control over the affected system's user authentication and authorization processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using LDAP over StartTLS with UAA or implement network-level protections to prevent man-in-the-middle attacks. Monitor vendor channels for updates and apply patches once released.