CVE-2019-3782 - CredHub CLI writes environment variable credentials to disk

Back Back to CVE browser

HIGH

CredHub CLI writes environment variable credentials to disk

Published Feb 13, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.36%

Description

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

Affected products

Vendor Cloud Foundry Product CredHub CLI Default
n/a
- Version
  All
  Status
  affected
  Constraints
  <2.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cloud Foundry

CredHub CLI

n/a

Version	Status	Constraints
All	affected	<2.2.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (2)

http://www.securityfocus.com/bid/107038
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://www.cloudfoundry.org/blog/cve-2019-3782
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/107038		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://www.cloudfoundry.org/blog/cve-2019-3782		x_refsource_CONFIRMVendor Advisory