Capi Cloud Foundry Controller
Monthly
Cloud Foundry CAPI versions before v1.248.0 and CF Deployment versions before 60.9.0 allow an authenticated SpaceDeveloper to redirect a space-scoped service broker's stored credentials to an attacker-controlled endpoint by changing the broker URL while leaving its credentials unchanged. This is an indirect credential-disclosure path because the CF API does not permit direct reading of broker credentials; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7), with impact limited to confidentiality. No public exploit was identified at time of analysis, and vendor patches are available in CAPI v1.248.0 and CF Deployment 60.9.0.
Cloud Foundry's Cloud Controller (CAPI) writes sensitive material into audit log records, so custom buildpack credentials, syslog drain URL credentials and service-binding parameters become readable by anyone with access to those audit events. Exploitation requires an authenticated principal (CVSS PR:L) who can read CAPI audit events and the occurrence of ordinary operations such as applying, creating or updating an app manifest, creating a user-provided service instance with a syslog drain URL, or binding a service. The exposure is passive - secrets are recorded whether or not an attacker does anything - so impact is bounded by how widely audit-event read access is granted in a given deployment; no public exploit code has been identified at time of analysis and the issue is a moderate-priority disclosure rather than an emergency.
Cloud Foundry CAPI versions before v1.248.0 and CF Deployment versions before 60.9.0 allow an authenticated SpaceDeveloper to redirect a space-scoped service broker's stored credentials to an attacker-controlled endpoint by changing the broker URL while leaving its credentials unchanged. This is an indirect credential-disclosure path because the CF API does not permit direct reading of broker credentials; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7), with impact limited to confidentiality. No public exploit was identified at time of analysis, and vendor patches are available in CAPI v1.248.0 and CF Deployment 60.9.0.
Cloud Foundry's Cloud Controller (CAPI) writes sensitive material into audit log records, so custom buildpack credentials, syslog drain URL credentials and service-binding parameters become readable by anyone with access to those audit events. Exploitation requires an authenticated principal (CVSS PR:L) who can read CAPI audit events and the occurrence of ordinary operations such as applying, creating or updating an app manifest, creating a user-provided service instance with a syslog drain URL, or binding a service. The exposure is passive - secrets are recorded whether or not an attacker does anything - so impact is bounded by how widely audit-event read access is granted in a given deployment; no public exploit code has been identified at time of analysis and the issue is a moderate-priority disclosure rather than an emergency.