PT-2019-16728 · Cloud Foundry · Cf Cli

Published 2019-08-05 · Updated 2019-10-09 · CVE-2019-3800

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CF CLI versions prior to 6.45.0

Description The issue allows a local authenticated malicious user with access to the CF CLI config file to act as the client who is the owner of the leaked credentials. This occurs because the CF CLI writes the client id and secret to its config file when the user authenticates with the --client-credentials flag.

Recommendations For CF CLI versions prior to 6.45.0, update to version 6.45.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CF CLI config file to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

CVE-2019-3800

Affected Products

Cf Cli

References · 5

• https://pivotal.io/security/cve-2019-3800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3800 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3800 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2019-3800 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3800 · Note