| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.credhub:spring-credhub-core | < 1.1.0 | 1.1.0 |
| credhub service broker | < 1.1.0 | 1.1.0 |
Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free