PT-2019-16728 · Cloud Foundry · Cf Cli

Publicado 2019-08-05 · Atualizado 2019-10-09 · CVE-2019-3800

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CF CLI versions prior to 6.45.0

Description The issue allows a local authenticated malicious user with access to the CF CLI config file to act as the client who is the owner of the leaked credentials. This occurs because the CF CLI writes the client id and secret to its config file when the user authenticates with the --client-credentials flag.

Recommendations For CF CLI versions prior to 6.45.0, update to version 6.45.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CF CLI config file to minimize the risk of exploitation.

Correção

Insufficiently Protected Credentials

Information Disclosure

Enumeração de Fraquezas

CWE-522

CWE-200

Identificadores relacionados

CVE-2019-3800

Produtos afetados

Cf Cli

Referências · 5

• https://pivotal.io/security/cve-2019-3800 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3800 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3800 · Aviso do Fabricante
• https://cloudfoundry.org/blog/cve-2019-3800 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3800 · Nota