PT-2019-16710

Name of the Vulnerable Software and Affected Versions Cloud Foundry Container Runtime versions prior to 0.28.0 Description The issue allows a malicious user with access to K8s nodes to obtain IAAS credentials, potentially escalating privileges to gain access to the IAAS account. This is due to a...

CVE-2019-3779: Improper Access Control

Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA Certificate Authority to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the...

CVE-2019-3784

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id...

CVE-2019-3784

CVE-2019-3784 affects Cloud Foundry Stratos prior to version 2.3.0 . The issue is an insecure session that can be spoofed when hosted on Cloud Foundry with multiple instances using the default embedded SQLite database, allowing a remote authenticated attacker to switch sessions to another user sh...

CVE-2019-3784 Cloud Foundry Stratos contains a Session Collision Vulnerability

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id...

CVE-2019-3783 Cloud Foundry Stratos Deploys With Public Default Session Store Secret

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user...

CVE-2019-3783

The CVE-2019-3783 entry affects Cloud Foundry Stratos prior to 2.3.0, where a public default session store secret can be brute-forced to hijack another user’s Stratos session and act on their behalf. Root cause: use of a public default session secret in deployed Stratos instances. Impact: attacke...

CVE-2019-3775

The CVE-2019-3775 entry concerns Cloud Foundry UAA prior to v70.0, where an authenticated user can modify their own email address, enabling impersonation of another user. The vulnerability is described as an authorization issue in multiple sources (CNVD/CVE records) and Cloud Foundry’s own adviso...

CVE-2019-3775

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user...

CVE-2019-3781 CF CLI does not sanitize user's password in verbose/trace/debug

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password...

CVE-2019-3781

CVE-2019-3781 affects Cloud Foundry CLI (cf-cli) prior to version 6.43.0. The root cause is improper redaction of passwords in verbose/trace/debug logging, enabling either local or remote attackers with log access to obtain part or all of a user’s password. Public docs from SUSE and OSV confirm t...

CVE-2019-3783

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user...

CVE-2019-3781

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password...

CVE-2019-3775 UAA allows users to modify their own email address

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user...

Default configuration

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user...

CVE-2019-3775

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user...

CVE-2019-3781

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password...

CVE-2019-3783

Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user...

CVE-2019-3784

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id...

Code injection

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user...