Bosh Deployment logs leak sensitive information
CVE-2019-11271

6MEDIUM

Key Information:

Vendor

Cloud Foundry

Status
Bosh
Vendor
CVE Published:
19 June 2019

What is CVE-2019-11271?

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.

Affected Version(s)

BOSH 270

References

https://www.cloudfoundry.org/blog/cve-2019-11271
x_refsource_CONFIRM

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

CVSS V3.0

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.