medium6.3
CVE-2019-3800
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred…
Impact
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pivotal | Cloud Foundry Command Line Interface | before 6.45.0 |
| Pivotal | Cloud Foundry Command Line Interface Release | before 1.16.0 |
| Pivotal | Cloud Foundry Deployment | before 10.0.0 |
| Pivotal | Cloud Foundry Deployment Concourse Tasks | before 9.3.0 |
| Pivotal | Cloud Foundry Log Cache Release | before 2.3.1 |
| Pivotal | Cloud Foundry Networking Release | before 2.23.0 |
| Pivotal | Cloud Foundry Notifications | before 58 |
| Pivotal | Cloud Foundry Routing Release | before 0.189.0 |
| Pivotal | Cloud Foundry Smoke Test | before 40.0.113 |
| Pivotal | Application Service | from 2.3.0 before 2.3.14 from 2.4.0 before 2.4.10 from 2.5.0 before 2.5.6 |
| Pivotal | Cloud Foundry Autoscaling Release | before 219 |
| Pivotal | Cloud Foundry Event Alerts | before 1.2.8 |