PT-2019-16712 · Cloud Foundry · Credhub Cli

Published 2019-02-13 · Updated 2020-10-19 · CVE-2019-3782

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry CredHub CLI versions prior to 2.2.1

Description The issue allows a local authenticated malicious user with access to the CredHub CLI config file to retrieve and modify credentials stored in CredHub. This is possible because the CredHub CLI inadvertently writes authentication credentials provided via environment variables to its persistent config file.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the CredHub CLI config file to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-3782

Affected Products

Credhub Cli

References · 4

• https://cloudfoundry.org/blog/cve-2019-3782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3782 · Security Note
• http://securityfocus.com/bid/107038 · Note