CVE-2019-3782

HIGH 7.8CVE-2019-3782 · Published 13/02/2019 · updated 17/06/2026

In short

CVE-2019-3782 is a HIGH (CVSS 7.8) vulnerability affecting credhub cli (cloudfoundry).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.5% of all vulnerabilities.
Fix: update to 2.2.1 or later.

Package	Affected versions	Patched versions
credhub cli cloudfoundry	`< 2.2.1`	`2.2.1`

Description

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

References

securityfocus.com/bid/107038 · Third Party Advisory
cloudfoundry.org/blog/cve-2019-3782 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free