CVE-2019-11271 Bosh Deployment logs leak sensitive information
An authenticated local user can read sensitive credentials from BOSH deployment logs when using a MySQL database.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11271?
CVE-2019-11271 is a medium-severity vulnerability in Cloud Foundry BOSH, published on 18 Jun 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.
Which versions are affected by CVE-2019-11271?
It affects 1 product.
Products include Cloud Foundry Bosh.
How do I fix CVE-2019-11271?
No fix has been published for CVE-2019-11271 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11271 being exploited?
There is no known exploitation of CVE-2019-11271 in the wild and no public exploit code.
Other vulnerabilities in Cloud Foundry BOSH
Sources
Also known as GHSA-8jpp-7p79-w764.