CVE-2018-15795

CredHub Service Broker uses guessable client secret

High · published November 13, 2018

CVSS v3.0
8.1
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01304 · 70.3th percentile
Published
2018-11-13T14:00Z
EPSS history
Timeline
  • 13 NOV 14:00Z
    CredHub Service Broker uses guessable client secret
    cvelistv5