CVE-2018-15797

NFS Volume release errand leaks cf admin credentials in logs

High · published December 5, 2018

CVSS v3.0
8.4
EPSS
2%
Percentile
75.3
In the wild
Unconfirmed
What it is

Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.

The record
Technical detail
CVSS v3.0
8.4 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01579 · 75.3th percentile
Published
2018-12-05T18:00Z
EPSS history
Timeline
  • 05 DEC 18:00Z
    NFS Volume release errand leaks cf admin credentials in logs
    cvelistv5