CVE-2019-3800

Home/CVE/CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th

CVE

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

MEDIUM · CVSS 6.3 EPSS 0.00279

Monitor

No active-exploitation, high-EPSS, or public-exploit signals - routine patching cadence

Sigma rules3 YARA rules0

⬡

Weakness Classification

CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-522Insufficiently Protected Credentials

▤

Affected Products & Versions

pivotal cloud foundry command line interface< 6.45.0
pivotal cloud foundry command line interface release< 1.16.0
pivotal cloud foundry deployment< 10.0.0
pivotal cloud foundry deployment concourse tasks< 9.3.0
pivotal cloud foundry log cache release< 2.3.1
pivotal cloud foundry networking release< 2.23.0
pivotal cloud foundry notifications< 58
pivotal cloud foundry routing release< 0.189.0
Show all 60 affected productspivotal cloud foundry smoke test< 40.0.113
pivotal application service>= 2.3.0 and < 2.3.14
pivotal application service>= 2.4.0 and < 2.4.10
pivotal application service>= 2.5.0 and < 2.5.6
pivotal cloud foundry autoscaling release< 219
pivotal cloud foundry event alerts< 1.2.8
pivotal cloud foundry healthwatch>= 1.4.0 and < 1.4.7
pivotal cloud foundry healthwatch>= 1.5.0 and < 1.5.4
pivotal credhub service broker for pcf< 1.3.2
pivotal metric registrar release< 1.2
pivotal on demand service broker< 0.29.0
pivotal cloud foundry service broker< 1.4.13
pivotal single sign-on>= 1.7.0 and < 1.7.5
pivotal single sign-on>= 1.8.0 and < 1.8.4
pivotal single sign-on>= 1.9.0 and < 1.9.1
anynines elasticsearch< 2.1.2
anynines logme< 2.1.2
anynines mongodb< 2.1.2
anynines mysql< 2.1.2
anynines postgresql< 2.1.2
anynines rabbitmq< 2.1.2
anynines redis< 2.1.2
apigee edge service broker< 3.1.3
appdynamics application analytics< 4.7.652
appdynamics application performance monitoring< 4.6.64
appdynamics platform montioring< 4.7.712
bluemedora nozzle< 3.1.1
contrastsecurity service broker< 2.2.0
cyberark conjur service broker< 1.1.1
datadoghq application monitoring< 1.7.0
datastax enterprise service broker< 1.0.2
dynatrace service broker< 1.4.2
forgerock service broker< 2.1.2
google cloud platform service broker< 4.2.3
ibm websphere liberty < 3.11.0
microsoft azure log analytics nozzle< 1.4.1
microsoft azure service broker< 1.4.1
newrelic dotnet extension buildpack< 1.1.1
newrelic nozzle< 1.1.17
newrelic service broker< 1.12.64
pagerduty service broker< 1.2.4
riverbed steelcentral appinternals< 10.21.1-bl516
samba volume service< 1.1.1
signalsciences service broker< 1.1.0
snyk service broker< 1.0.3
solace pubsub\+< 2.3.2
splunk nozzle< 1.1.1
sumologic nozzle< 1.0.1
synopsys seeker iast service broker< 1.2.14
tibco businessworks buildpack< 2.4.4
wavefront by vmware nozzle< 1.0.2
yugabyte db enterprise< 1.1.8

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

producthighOpenCanary - MySQL Login Attempt

producthighUncommon File Creation By Mysql Daemon Process

producthighOpenCanary - REDIS Action Command Attempt

▣

Scoring & Timeline

6.3

MEDIUM · CVSS v3.0 · security_alert@emc.com

View on NVD

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

Published to NVD05 Aug 2019 · 05:15 PM

CVSS VectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

https://pivotal.io/security/cve-2019-3800Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2019-3800Vendor Advisory

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin