| Summary | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials. |
|---|---|
| Publication Date | Aug. 6, 2019, 2:15 a.m. |
| Registration Date | Jan. 26, 2021, 11:42 a.m. |
| Last Update | Nov. 21, 2024, 1:42 p.m. |
| CVSS3.0 : HIGH | |
| スコア | 7.8 |
|---|---|
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 攻撃元区分(AV) | ローカル |
| 攻撃条件の複雑さ(AC) | 低 |
| 攻撃に必要な特権レベル(PR) | 低 |
| 利用者の関与(UI) | 不要 |
| 影響の想定範囲(S) | 変更なし |
| 機密性への影響(C) | 高 |
| 完全性への影響(I) | 高 |
| 可用性への影響(A) | 高 |
| CVSS2.0 : LOW | |
| Score | 2.1 |
|---|---|
| Vector | AV:L/AC:L/Au:N/C:P/I:N/A:N |
| 攻撃元区分(AV) | ローカル |
| 攻撃条件の複雑さ(AC) | 低 |
| 攻撃前の認証要否(Au) | 不要 |
| 機密性への影響(C) | 低 |
| 完全性への影響(I) | なし |
| 可用性への影響(A) | なし |
| Get all privileges. | いいえ |
| Get user privileges | いいえ |
| Get other privileges | いいえ |
| User operation required | いいえ |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:pivotal:cloud_foundry_notifications:*:*:*:*:*:*:*:* | 58 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_log_cache_release:*:*:*:*:*:*:*:* | 2.3.1 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_deployment_concourse_tasks:*:*:*:*:*:*:*:* | 9.3.0 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_deployment:*:*:*:*:*:*:*:* | 10.0.0 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_smoke_test:*:*:*:*:*:*:*:* | 40.0.113 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_routing_release:*:*:*:*:*:*:*:* | 0.189.0 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_networking_release:*:*:*:*:*:*:*:* | 2.23.0 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_command_line_interface_release:*:*:*:*:*:*:*:* | 1.16.0 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_command_line_interface:*:*:*:*:*:*:*:* | 6.45.0 | ||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:a:pivotal:pivotal_cloud_foundry_service_broker:*:*:*:*:*:aws:*:* | 1.4.13 | ||||
| cpe:2.3:a:pivotal:on_demand_service_broker:*:*:*:*:*:*:*:* | 0.29.0 | ||||
| cpe:2.3:a:pivotal:metric_registrar_release:*:*:*:*:*:*:*:* | 1.2 | ||||
| cpe:2.3:a:pivotal:credhub_service_broker_for_pcf:*:*:*:*:*:*:*:* | 1.3.2 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_autoscaling_release:*:*:*:*:*:*:*:* | 219 | ||||
| cpe:2.3:a:pivotal:cloud_foundry_event_alerts:*:*:*:*:*:*:*:* | 1.2.8 | ||||
| cpe:2.3:a:pivotal:application_service:*:*:*:*:*:*:*:* | 2.5.0 | 2.5.6 | |||
| cpe:2.3:a:pivotal:application_service:*:*:*:*:*:*:*:* | 2.4.0 | 2.4.10 | |||
| cpe:2.3:a:pivotal:application_service:*:*:*:*:*:*:*:* | 2.3.0 | 2.3.14 | |||
| cpe:2.3:a:pivotal:cloud_foundry_healthwatch:*:*:*:*:*:*:*:* | 1.5.0 | 1.5.4 | |||
| cpe:2.3:a:pivotal:cloud_foundry_healthwatch:*:*:*:*:*:*:*:* | 1.4.0 | 1.4.7 | |||
| cpe:2.3:a:pivotal:single_sign-on:*:*:*:*:*:cloud_foundry:*:* | 1.9.0 | 1.9.1 | |||
| cpe:2.3:a:pivotal:single_sign-on:*:*:*:*:*:cloud_foundry:*:* | 1.8.0 | 1.8.4 | |||
| cpe:2.3:a:pivotal:single_sign-on:*:*:*:*:*:cloud_foundry:*:* | 1.7.0 | 1.7.5 | |||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:a:apigee:edge_service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 3.1.3 | ||||
| cpe:2.3:a:newrelic:dotnet_extension_buildpack:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.1 | ||||
| cpe:2.3:a:microsoft:azure_service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.4.1 | ||||
| cpe:2.3:a:appdynamics:application_analytics:*:*:*:*:*:pivotal_cloud_foundry:*:* | 4.7.652 | ||||
| cpe:2.3:a:appdynamics:application_performance_monitoring:*:*:*:*:*:pivotal_cloud_foundry:*:* | 4.6.64 | ||||
| cpe:2.3:a:appdynamics:platform_montioring:*:*:*:*:*:pivotal_cloud_foundry:*:* | 4.7.712 | ||||
| cpe:2.3:a:bluemedora:nozzle:*:*:*:*:*:pivotal_cloud_foundry:*:* | 3.1.1 | ||||
| cpe:2.3:a:contrastsecurity:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.2.0 | ||||
| cpe:2.3:a:cyberark:conjur_service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.1 | ||||
| cpe:2.3:a:datadoghq:application_monitoring:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.7.0 | ||||
| cpe:2.3:a:datastax:enterprise_service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.0.2 | ||||
| cpe:2.3:a:dynatrace:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.4.2 | ||||
| cpe:2.3:a:forgerock:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:google:google_cloud_platform_service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 4.2.3 | ||||
| cpe:2.3:a:ibm:websphere_liberty_:*:*:*:*:*:pivotal_cloud_foundry:*:* | 3.11.0 | ||||
| cpe:2.3:a:microsoft:azure_log_analytics_nozzle:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.4.1 | ||||
| cpe:2.3:a:newrelic:nozzle:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.17 | ||||
| cpe:2.3:a:newrelic:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.12.64 | ||||
| cpe:2.3:a:pagerduty:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.2.4 | ||||
| cpe:2.3:a:riverbed:steelcentral_appinternals:*:*:*:*:*:pivotal_cloud_foundry:*:* | 10.21.1-bl516 | ||||
| cpe:2.3:a:signalsciences:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.0 | ||||
| cpe:2.3:a:wavefront:wavefront_by_vmware_nozzle:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.0.2 | ||||
| cpe:2.3:a:tibco:businessworks_buildpack:*:*:*:*:container:pivotal_cloud_foundry:*:* | 2.4.4 | ||||
| cpe:2.3:a:solace:pubsub\+:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.3.2 | ||||
| cpe:2.3:a:snyk:service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.0.3 | ||||
| cpe:2.3:a:samba:volume_service:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.1 | ||||
| cpe:2.3:a:splunk:nozzle:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.1 | ||||
| cpe:2.3:a:sumologic:nozzle:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.0.1 | ||||
| cpe:2.3:a:synopsys:seeker_iast_service_broker:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.2.14 | ||||
| cpe:2.3:a:yugabyte:db_enterprise:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1.1.8 | ||||
| cpe:2.3:a:anynines:elasticsearch:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:anynines:logme:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:anynines:mysql:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:anynines:postgresql:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:anynines:rabbitmq:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:anynines:redis:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| cpe:2.3:a:anynines:mongodb:*:*:*:*:*:pivotal_cloud_foundry:*:* | 2.1.2 | ||||
| Title | CF CLI における情報漏えいに関する脆弱性 |
|---|---|
| Summary | CF CLI には、情報漏えいに関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | July 18, 2019, midnight |
| Registration Date | Aug. 15, 2019, 5:48 p.m. |
| Last Update | Aug. 15, 2019, 5:48 p.m. |
| Pivotal Software, Inc. |
| Pivotal Application Service |
| Cloud Foundry Foundation |
| Command Line Interface 6.45.0 未満 |
| Command Line Interface Release |
| Deployment |
| Deployment Concourse Tasks |
| Log Cache Release |
| Networking Release |
| Notifications |
| Routing Release |
| Smoke Tests |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2019年08月15日] 掲載 |
Aug. 15, 2019, 5:48 p.m. |