Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-3800

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

Published

2019-08-05T17:15:10.960

Last Modified

2024-11-21T04:42:33.957

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.3 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-522
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application pivotal cloud_foundry_command_line_interface < 6.45.0 Yes
Application pivotal cloud_foundry_command_line_interface_release < 1.16.0 Yes
Application pivotal cloud_foundry_deployment < 10.0.0 Yes
Application pivotal cloud_foundry_deployment_concourse_tasks < 9.3.0 Yes
Application pivotal cloud_foundry_log_cache_release < 2.3.1 Yes
Application pivotal cloud_foundry_networking_release < 2.23.0 Yes
Application pivotal cloud_foundry_notifications < 58 Yes
Application pivotal cloud_foundry_routing_release < 0.189.0 Yes
Application pivotal cloud_foundry_smoke_test < 40.0.113 Yes
Application pivotal application_service < 2.3.14 Yes
Application pivotal application_service < 2.4.10 Yes
Application pivotal application_service < 2.5.6 Yes
Application pivotal cloud_foundry_autoscaling_release < 219 Yes
Application pivotal cloud_foundry_event_alerts < 1.2.8 Yes
Application pivotal cloud_foundry_healthwatch < 1.4.7 Yes
Application pivotal cloud_foundry_healthwatch < 1.5.4 Yes
Application pivotal credhub_service_broker_for_pcf < 1.3.2 Yes
Application pivotal metric_registrar_release < 1.2 Yes
Application pivotal on_demand_service_broker < 0.29.0 Yes
Application pivotal pivotal_cloud_foundry_service_broker < 1.4.13 Yes
Application pivotal single_sign-on < 1.7.5 Yes
Application pivotal single_sign-on < 1.8.4 Yes
Application pivotal single_sign-on < 1.9.1 Yes
Application anynines elasticsearch < 2.1.2 Yes
Application anynines logme < 2.1.2 Yes
Application anynines mongodb < 2.1.2 Yes
Application anynines mysql < 2.1.2 Yes
Application anynines postgresql < 2.1.2 Yes
Application anynines rabbitmq < 2.1.2 Yes
Application anynines redis < 2.1.2 Yes
Application apigee edge_service_broker < 3.1.3 Yes
Application appdynamics application_analytics < 4.7.652 Yes
Application appdynamics application_performance_monitoring < 4.6.64 Yes
Application appdynamics platform_montioring < 4.7.712 Yes
Application bluemedora nozzle < 3.1.1 Yes
Application contrastsecurity service_broker < 2.2.0 Yes
Application cyberark conjur_service_broker < 1.1.1 Yes
Application datadoghq application_monitoring < 1.7.0 Yes
Application datastax enterprise_service_broker < 1.0.2 Yes
Application dynatrace service_broker < 1.4.2 Yes
Application forgerock service_broker < 2.1.2 Yes
Application google google_cloud_platform_service_broker < 4.2.3 Yes
Application ibm websphere_liberty_ < 3.11.0 Yes
Application microsoft azure_log_analytics_nozzle < 1.4.1 Yes
Application microsoft azure_service_broker < 1.4.1 Yes
Application newrelic dotnet_extension_buildpack < 1.1.1 Yes
Application newrelic nozzle < 1.1.17 Yes
Application newrelic service_broker < 1.12.64 Yes
Application pagerduty service_broker < 1.2.4 Yes
Application riverbed steelcentral_appinternals < 10.21.1-bl516 Yes
Application samba volume_service < 1.1.1 Yes
Application signalsciences service_broker < 1.1.0 Yes
Application snyk service_broker < 1.0.3 Yes
Application solace pubsub\+ < 2.3.2 Yes
Application splunk nozzle < 1.1.1 Yes
Application sumologic nozzle < 1.0.1 Yes
Application synopsys seeker_iast_service_broker < 1.2.14 Yes
Application tibco businessworks_buildpack < 2.4.4 Yes
Application wavefront wavefront_by_vmware_nozzle < 1.0.2 Yes
Application yugabyte db_enterprise < 1.1.8 Yes
References