CVE-2019-3800

CF CLI before v6.45.0 (bosh release 1.16.0) stores the client id and secret in the CLI config file upon authentication with --client-credentials. A local authenticated user with access to that config can impersonate the leaked client. Impact is high for confidentiality and integrity of the creden...

CVE-2023-20885

CVE-2023-20885 affects Cloud Foundry components: Notifications, SMB-volume, and cf-nfs-volume. The root issue is leakage of credentials through kernel audit logs, where arguments passed to binaries that access the filesystem can disclose admin/service credentials (e.g., cf auth --client-credentia...