CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
References
Link | Resource |
---|---|
https://pivotal.io/security/cve-2019-3800 | Vendor Advisory |
https://www.cloudfoundry.org/blog/cve-2019-3800 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2019-08-05 17:15
Updated : 2024-02-28 17:08
NVD link : CVE-2019-3800
Mitre link : CVE-2019-3800
CVE.ORG link : CVE-2019-3800
JSON object : View
Products Affected
pivotal
- cloud_foundry_networking_release
- application_service
- cloud_foundry_smoke_test
- cloud_foundry_notifications
- cloud_foundry_log_cache_release
- single_sign-on
- cloud_foundry_deployment_concourse_tasks
- cloud_foundry_autoscaling_release
- pivotal_cloud_foundry_service_broker
- cloud_foundry_routing_release
- cloud_foundry_event_alerts
- credhub_service_broker_for_pcf
- cloud_foundry_deployment
- on_demand_service_broker
- metric_registrar_release
- cloud_foundry_command_line_interface
- cloud_foundry_healthwatch
- cloud_foundry_command_line_interface_release
datadoghq
- application_monitoring
signalsciences
- service_broker
samba
- volume_service
dynatrace
- service_broker
yugabyte
- db_enterprise
appdynamics
- application_performance_monitoring
- application_analytics
- platform_montioring
tibco
- businessworks_buildpack
snyk
- service_broker
sumologic
- nozzle
anynines
- rabbitmq
- mysql
- postgresql
- elasticsearch
- logme
- mongodb
- redis
microsoft
- azure_service_broker
- azure_log_analytics_nozzle
contrastsecurity
- service_broker
splunk
- nozzle
newrelic
- dotnet_extension_buildpack
- nozzle
- service_broker
datastax
- enterprise_service_broker
- google_cloud_platform_service_broker
pagerduty
- service_broker
forgerock
- service_broker
synopsys
- seeker_iast_service_broker
wavefront
- wavefront_by_vmware_nozzle
solace
- pubsub\+
riverbed
- steelcentral_appinternals
cyberark
- conjur_service_broker
bluemedora
- nozzle
apigee
- edge_service_broker
ibm
- websphere_liberty_