CVE-2019-11294 CAPI leaks service broker URLs and GUIDs to space developers

2019-12-1900:00:00

CWE-200

pivotal

www.cve.org

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.

CNA Affected

[
  {
    "product": "CAPI",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "status": "affected",
        "version": "1.88.0"
      }
    ]
  }
]