CVE-2019-11271
High
Description
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.
SeverityHigh
CVSS7.8
Exploit probability—
ProductCloud Foundry Bosh
PublishedJun 19, 2019
First seenJun 19, 2019
Weakness typeCWE-532CWE-532
How to fix
Update
- cloud_foundry bosh270.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloud_foundry bosh | 270.0.0 ≤ v < 270.1.1 | 270.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.