CVE-2019-3782
CredHub CLI writes environment variable credentials to disk
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.3EPSS 0.4%KEV nãoPoC —Patch —
Lifecycle
Feb 13, 2019Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
Cloud Foundry · CredHub CLIWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →