CVE-2018-15797

Published: Dec 5, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.

Affected (3)

Products: Pivotal Software: Cloud Foundry Nfs Volume

Pivotal Software

1 product

Cloud Foundry Nfs Volume

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Cloud Foundry Nfs Volume	From 1.2.0 to 1.2.5
Pivotal Software Cloud Foundry Nfs Volume	From 1.5.0 to 1.5.4
Pivotal Software Cloud Foundry Nfs Volume	From 1.7.0 to 1.7.3

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

https://www.cloudfoundry.org/blog/cve-2018-15797

Source: security_alert@emc.com

Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2018-15797

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.