What is the CVSS score of CVE-2019-3800?

CVE-2019-3800 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.1%.

Cloud Foundry Command Line Interface CVE-2019-3800

HIGH

Insufficiently Protected Credentials (CWE-522)

2019-08-05 security_alert@emc.com

Information Disclosure Cloud Foundry Command Line Interface Cloud Foundry Command Line Interface Release Cloud Foundry Deployment Cloud Foundry Deployment Concourse Tasks Cloud Foundry Log Cache Release Cloud Foundry Networking Release Cloud Foundry Notifications Cloud Foundry Routing Release Cloud Foundry Smoke Test Application Service Cloud Foundry Autoscaling Release Cloud Foundry Event Alerts Cloud Foundry Healthwatch Credhub Service Broker For Pcf Metric Registrar Release On Demand Service Broker Pivotal Cloud Foundry Service Broker Single Sign On Elasticsearch Logme MongoDB MySQL PostgreSQL Rabbitmq Redis Edge Service Broker Application Analytics Application Performance Monitoring Platform Montioring Nozzle Service Broker Conjur Service Broker Application Monitoring Enterprise Service Broker Google Cloud Platform Service Broker Websphere Liberty Azure Log Analytics Nozzle Azure Service Broker Dotnet Extension Buildpack Steelcentral Appinternals Volume Service Pubsub Seeker Iast Service Broker Businessworks Buildpack Wavefront By Vmware Nozzle Db Enterprise

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 05, 2019 - 17:15 nvd

HIGH 7.8

DescriptionNVD

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

AnalysisAI

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials. Affected products include: Pivotal Cloud Foundry Command Line Interface, Pivotal Cloud Foundry Command Line Interface Release, Pivotal Cloud Foundry Deployment, Pivotal Cloud Foundry Deployment Concourse Tasks, Pivotal Cloud Foundry Log Cache Release. Version information: version 1.16.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.