PT-2019-16711 · Cloud Foundry+1 · Cloud Foundry+1

Published 2019-03-07 · Updated 2020-10-19 · CVE-2019-3781

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry CLI versions prior to 6.43.0

Description The issue improperly exposes passwords when verbose, trace, or debugging modes are enabled. A malicious user, either local and unauthenticated or remote and authenticated, with access to logs may be able to obtain part or all of a user's password.

Recommendations For versions prior to 6.43.0, update to version 6.43.0 or later to resolve the issue. As a temporary workaround, consider disabling verbose, trace, and debugging modes to minimize the risk of password exposure. Restrict access to logs to prevent unauthorized users from gaining access to sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-215

CWE-200

Related Identifiers

CVE-2019-3781

SUSE-SU-2019:1220-1

SUSE-SU-2019:1220-2

SUSE-SU-2019_1220-1

SUSE-SU-2019_1220-2

Affected Products

Cloud Foundry

Suse

References · 30

• https://osv.dev/vulnerability/SUSE-SU-2019:1220-2 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2019-3781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3781 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1220-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3781 · Vendor Advisory
• https://github.com/cloudfoundry/cli/releases/tag/v6.39.0 · Note
• https://github.com/cloudfoundry/capi-release/releases/tag/1.58.0 · Note
• https://pivotaltracker.com/story/show/161556511 · Note
• https://suse.com/support/update/announcement/2019/suse-su-20191220-2 · Note
• https://suse.com/security/cve/CVE-2019-3781.html · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://pivotaltracker.com/story/show/161251875 · Note
• https://pivotaltracker.com/story/show/162428661 · Note
• https://pivotaltracker.com/story/show/162699756 · Note
• https://pivotaltracker.com/story/show/162747373 · Note