CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-20885 – CF workflows leak credentials in system audit logs
https://notcve.org/view.php?id=CVE-2023-20885
Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19. • https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-15797 – NFS Volume release errand leaks cf admin credentials in logs
https://notcve.org/view.php?id=CVE-2018-15797
Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand. Cloud Foundry NFS volume release, en versiones 1.2.x anteriores a la 1.2.5, versiones 1.5.x anteriores a la 1.5.4 y versiones 1.7.x anteriores a la 1.7.3, registra el nombre de usuario y contraseña del administrador cf al ejecutar tareas de despliegue BOSH nfsbrokerpush. Un usuario autenticado remoto con acceso a BOSH puede obtener las credenciales de administrador para la Cloud Foundry Platform mediante los registros de la tarea de despliegue del volumen NFS. • https://www.cloudfoundry.org/blog/cve-2018-15797 • CWE-532: Insertion of Sensitive Information into Log File •