PT-2019-16712 · Cloud Foundry · Credhub Cli

Publicado 2019-02-13 · Atualizado 2020-10-19 · CVE-2019-3782

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry CredHub CLI versions prior to 2.2.1

Description The issue allows a local authenticated malicious user with access to the CredHub CLI config file to retrieve and modify credentials stored in CredHub. This is possible because the CredHub CLI inadvertently writes authentication credentials provided via environment variables to its persistent config file.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the CredHub CLI config file to minimize the risk of exploitation.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-3782

Produtos afetados

Credhub Cli

Referências · 4

• https://cloudfoundry.org/blog/cve-2019-3782 · Aviso do Fabricante
• http://securityfocus.com/bid/107038 · Nota
• https://osv.dev/vulnerability/CVE-2019-3782 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3782 · Nota de Segurança