CVE-2021-22115
Medium
Description
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller.
SeverityMedium
CVSS6.5
Exploit probability58. percentile0.8%
ProductCloudfoundry Capi-release
PublishedApr 8, 2021
First seenApr 8, 2021
How to fix
Update
- cloudfoundry capi-release1.106.0 or later
- cloudfoundry cf-deployment16.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry capi-release | v < 1.106.0 | 1.106.0 |
| cloudfoundry cf-deployment | v < 16.2.0 | 16.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.