CVE-2019-3800 — Insufficiently Protected Credentials in Cloud Foundry Autoscaling Release

CWE-522 — Insufficiently Protected CredentialsCWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
7.8HIGHNVD
CNA6.3
EPSS
0.2%
top 57.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
57
Anynines ElasticsearchAnynines LogmeAnynines Mongodb+54 more
Timeline
PublishedAug 5
Latest updateMay 24

Description

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages57 packages

🔴Vulnerability Details

2
GHSA
GHSA-2wpx-p7qg-954w: CF CLI version prior to v6↗2022-05-24
▶
CVEList
CF CLI writes the client id and secret to config file↗2019-08-05
▶
CVE-2019-3800 — Insufficiently Protected Credentials | cvebase