Lucene search

DellCVELIST:CVE-2019-3782

HistoryFeb 11, 2019 - 12:00 a.m.

CVE-2019-3782 CredHub CLI writes environment variable credentials to disk

2019-02-1100:00:00

CWE-522

dell

www.cve.org

6.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

CNA Affected

[
  {
    "product": "CredHub CLI",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "lessThan": "2.2.1",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107038

www.cloudfoundry.org/blog/cve-2019-3782