Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

cloud foundry bosh vulnerabilities and exploits

(subscribe to this query)
4
CVSSv2
CVE-2020-5422
BOSH System Metrics Server releases before 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).
Cloud Foundry Bosh System Metrics Server
2.1
CVSSv2
CVE-2019-3800
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is t...
Pivotal Cloud Foundry Deployment Concourse TasksPivotal Cloud Foundry DeploymentPivotal Cloud Foundry Smoke TestPivotal Cloud Foundry Routing ReleasePivotal Cloud Foundry NotificationsPivotal Cloud Foundry Command Line Interface ReleasePivotal Cloud Foundry Log Cache ReleasePivotal Cloud Foundry Networking ReleasePivotal Cloud Foundry Command Line InterfacePivotal Cloud Foundry HealthwatchPivotal Credhub Service Broker For PcfPivotal Metric Registrar ReleasePivotal On Demand Service BrokerPivotal Application ServicePivotal Cloud Foundry Autoscaling ReleasePivotal Pivotal Cloud Foundry Service BrokerPivotal Single Sign-onPivotal Cloud Foundry Event AlertsAppdynamics Platform MontioringBluemedora NozzleContrastsecurity Service BrokerCyberark Conjur Service Broker
2.1
CVSSv2
CVE-2019-11271
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.
Cloud Foundry Bosh
4
CVSSv2
CVE-2019-3786
Cloud Foundry BOSH Backup and Restore CLI, all versions before 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs u...
Cloudfoundry Bosh Backup And Restore
4
CVSSv2
CVE-2018-15797
Cloud Foundry NFS volume release, 1.2.x before 1.2.5, 1.5.x before 1.5.4, 1.7.x before 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud ...
Pivotal Software Cloud Foundry Nfs Volume
6.8
CVSSv2
CVE-2018-11083
Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be...
Cloud Foundry Bosh
6.5
CVSSv2
CVE-2018-1231
Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. A user with access to an instance using the BOSH CLI can access the BOSH CLI configuration file and use its contents to perform authenticated requests to BOSH.
Pivotal Software Bosh Cli
5
CVSSv2
CVE-2015-5350
In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end use...
Cloudfoundry Garden
4.3
CVSSv2
CVE-2018-1190
An issue exists in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter o...
Pivotal Uaa BoshPivotal UaaCloudfoundry Cf-release
6
CVSSv2
CVE-2017-8032
In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions pri...
Pivotal Software Cloud Foundry Uaa 2.2.5.4Pivotal Software Cloud Foundry Uaa 2.7.1Pivotal Software Cloud Foundry Uaa 2.7.2Pivotal Software Cloud Foundry Uaa 2.7.3Pivotal Software Cloud Foundry Uaa 2.7.4.14Pivotal Software Cloud Foundry Uaa 2.7.4.15Pivotal Software Cloud Foundry Uaa 2.7.4.16Pivotal Software Cloud Foundry Uaa 3.6.1Pivotal Software Cloud Foundry Uaa 3.9.3Pivotal Software Cloud Foundry Uaa 3.9.4Pivotal Software Cloud Foundry Uaa 3.9.5Pivotal Software Cloud Foundry Uaa 3.9.6Pivotal Software Cloud Foundry Uaa 2.7.4Pivotal Software Cloud Foundry Uaa 2.7.4.2Pivotal Software Cloud Foundry Uaa 2.7.4.4Pivotal Software Cloud Foundry Uaa 2.7.4.9Pivotal Software Cloud Foundry Uaa 2.7.4.12Pivotal Software Cloud Foundry Uaa 3.6.3Pivotal Software Cloud Foundry Uaa 3.6.5Pivotal Software Cloud Foundry Uaa 3.6.12Pivotal Software Cloud Foundry Uaa 3.9.2Pivotal Software Cloud Foundry Uaa 3.9.7
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925CVE-2023-41826LFICVE-2022-22364CVE-2024-2887command injectionremote code executionCVE-2024-34446CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook