CVE-2019-11271CWE-532

Bosh Deployment logs leak sensitive information

Medium · published June 18, 2019

CVSS v3.0
6.0
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.

The record
Technical detail
CVSS v3.0
6.0 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2019-06-18T23:38Z
EPSS history
Timeline
  • 18 JUN 23:38Z
    Bosh Deployment logs leak sensitive information
    cvelistv5