CVE-2019-3800
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2019
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
CF CLI writes the client id and secret to config file
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CF CLI Release
- Vendor
- Cloud Foundry
- Product
- CF CLI Release
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| v1.x before v1.16.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
CF CLI
- Vendor
- Cloud Foundry
- Product
- CF CLI
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| versions prior to v6.45.0 | affected | Unavailable | Unavailable | Unavailable | None listed |