CVE-2019-3780CWE-260

Cloud Foundry Container Runtime Leaks IAAS Credentials

Critical · published March 8, 2019

CVSS v3.0
9.1
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.

The record
Technical detail
CVSS v3.0
9.1 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01429 · 72.8th percentile
Weakness
CWE-260 · Password in Configuration File
Published
2019-03-08T16:00Z
EPSS history
Timeline
  • 08 MAR 16:00Z
    Cloud Foundry Container Runtime Leaks IAAS Credentials
    cvelistv5