Read the docs

Cloud Foundry

Records84All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high47CVSS 7.0–8.9

Exploited now

Cloud Foundry records in CISA KEV

No Cloud Foundry vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Bosh 5 records LOW Bits Service 1 record LOW Bosh System Metrics Server 1 record LOW Cf-networking 1 record MEDIUM Diego 1 record LOW

Records

5 records in Bosh · all components

TI-2018-07869 CVE-2018-11083 · GHSA-rj7c-vg4r-rx5m

Bosh accepts refresh tokens in place of an access token

Priority LOW 38

Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01483 Published 2018-10-05 Fixed in v264.14.0, v265.7.0 +2
TI-2019-08429 CVE-2019-11271 · GHSA-8jpp-7p79-w764

Bosh Deployment logs leak sensitive information

Priority LOW 34

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00286 Published 2019-06-18 Fixed in v270.1.1 CWE-532
Open these records in search →