What is CVE-2018-15797?

CVE-2018-15797 is a high-severity vulnerability in Cloud Foundry Nfs Volume Release, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.4/10. Published 2018-12-05.

How severe is CVE-2018-15797?

High severity. CVSS v3 base score is 8.4 out of 10.

Information disclosure in Cloud Foundry Nfs Volume Release

CVE-2018-15797

Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.

EPSS: 0.016 (73.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Cloud Foundry Nfs Volume Release — versions 1.5, 1.7, 1.2
Pivotal_software Cloud_foundry_nfs_volume

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

security_alert@emc.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-15797?: CVE-2018-15797 is a high-severity vulnerability in Cloud Foundry Nfs Volume Release, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.4/10. Published 2018-12-05.
How severe is CVE-2018-15797?: High severity. CVSS v3 base score is 8.4 out of 10.