CVE-2019-3782

ALTO 7.8CVE-2019-3782 · Published 13/02/2019 · updated 17/06/2026

In breve

CVE-2019-3782 è una vulnerabilità ALTO (CVSS 7.8) che riguarda credhub cli (cloudfoundry).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.36%, superiore al 29.5% delle vulnerabilità.
Correzione: aggiornare a 2.2.1 o successiva.

Package	Affected versions	Patched versions
credhub cli cloudfoundry	`< 2.2.1`	`2.2.1`

Description

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

References

securityfocus.com/bid/107038 · Third Party Advisory
cloudfoundry.org/blog/cve-2019-3782 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free