CVE-2020-5422

BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).
References
Link Resource
https://www.cloudfoundry.org/blog/cve-2020-5422 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cloud_foundry:bosh_system_metrics_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-10-02 17:15

Updated : 2024-02-28 18:08


NVD link : CVE-2020-5422

Mitre link : CVE-2020-5422

CVE.ORG link : CVE-2020-5422


JSON object : View

Products Affected

cloud_foundry

  • bosh_system_metrics_server
CWE
CWE-668

Exposure of Resource to Wrong Sphere

CWE-214

Invocation of Process Using Visible Sensitive Information