Information disclosure in Cloud Foundry Cf Deployment
CVE-2019-11283
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Cloud Foundry Cf Deployment — versions All
- Cloud Foundry SMB Volume — versions All
- Cloudfoundry Cf-Deployment
- Pivotal Software Cloud Foundry SMB Volume
Weakness classification (CWE)
References
- www.cloudfoundry.org/blog/cve-2019-11283 (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11283?
- CVE-2019-11283 is a high-severity vulnerability in Cloud Foundry Cf Deployment, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.8/10. Published 2019-10-23.
- How severe is CVE-2019-11283?
- High severity. CVSS v3 base score is 8.8 out of 10.