Information disclosure in Cloud Foundry Cf Deployment
CVE-2019-11283
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.
EPSS: 0.015 (71.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cloud Foundry Cf Deployment — versions All
- Cloud Foundry Smb Volume — versions All
- Cloudfoundry Cf-deployment
- Pivotal_software Cloud_foundry_smb_volume
Weakness classification (CWE)
References
- security@pivotal.io (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11283?
- CVE-2019-11283 is a high-severity vulnerability in Cloud Foundry Cf Deployment, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.8/10. Published 2019-10-23.
- How severe is CVE-2019-11283?
- High severity. CVSS v3 base score is 8.8 out of 10.