CVE-2019-11283 — Log File Information Exposure in Foundry CF Deployment

CWE-532 — Log File Information Exposure3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 35.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cloud Foundry CF DeploymentCloud Foundry SMB VolumeCloudfoundry Cf-deployment+1 more
Timeline
PublishedOct 23
Latest updateMay 24

Description

Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5cloud_foundry/smb_volumeAll — v2.0.3
▶CVEListV5cloud_foundry/cf_deploymentAll — v12.2.0

🔴Vulnerability Details

2
GHSA
GHSA-mf6g-2h9h-jw37: Cloud Foundry SMB Volume, versions prior to v2↗2022-05-24
▶
CVEList
Password leak in smbdriver logs↗2019-10-23
▶
CVE-2019-11283 — Log File Information Exposure | cvebase