Intel

CVE-2019-3782

credhub_cli: Insufficiently Protected Credentials (CVE-2019-3782)

highEPSS 0.4%

Description

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

Source: CVELISTV5NVD

Metrics

Severity
high
Priority score
48.77
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
6.3
CVSS v4
—
EPSS percentile
29.0 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2019-02-13 16:00 UTC
CWE
CWE-522

Weakness classes (CWE)

  • CWE-522Class

    Insufficiently Protected Credentials

    The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cloudfoundry

    credhub_cli2.2.1

References & sources

IDCVE-2019-3782