CF CLI writes the client id and secret to config file

published 2019-08-05 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13427

cvss: 6.3; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.1%; EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits: 0; none known

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

Patch / fix

fixed in 20

pivotal cloud_foundry_command_line_interface 6.45.0
pivotal cloud_foundry_command_line_interface_release 1.16.0
pivotal cloud_foundry_deployment 10.0.0
pivotal cloud_foundry_deployment_concourse_tasks 9.3.0
pivotal cloud_foundry_log_cache_release 2.3.1
pivotal cloud_foundry_networking_release 2.23.0
pivotal cloud_foundry_notifications 58
pivotal cloud_foundry_routing_release 0.189.0
pivotal cloud_foundry_smoke_test 40.0.113
pivotal application_service 2.3.14, 2.4.10, 2.5.6
pivotal cloud_foundry_autoscaling_release 219
pivotal cloud_foundry_event_alerts 1.2.8
pivotal cloud_foundry_healthwatch 1.4.7, 1.5.4
pivotal credhub_service_broker_for_pcf 1.3.2
pivotal metric_registrar_release 1.2
pivotal on_demand_service_broker 0.29.0
pivotal pivotal_cloud_foundry_service_broker 1.4.13
pivotal single_sign-on 1.7.5, 1.8.4, 1.9.1
anynines elasticsearch 2.1.2
anynines logme 2.1.2

Exploit prediction

2.09% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

Cloud Foundry CF CLI Release
Cloud Foundry CF CLI

Classification

Weakness

CWE-522 Insufficiently Protected Credentials
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

cloudfoundry.org /blog/cve-2019-3800
vendor-advisory
pivotal.io /security/cve-2019-3800
vendor-advisory

Sources

CVE List CVE-2019-3800
NVD CVE-2019-3800

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary