CVE-2018-15797
Last modified
CVE-2018-15797 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.. EPSS estimates a 1.58% chance of exploitation in the next 30 days.
Description
Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.
Metrics
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Cloud Foundry Nfs Volume | >= 1.2.0, < 1.2.5 |
| Pivotal Software | Cloud Foundry Nfs Volume | >= 1.5.0, < 1.5.4 |
| Pivotal Software | Cloud Foundry Nfs Volume | >= 1.7.0, < 1.7.3 |
References
- https://www.cloudfoundry.org/blog/cve-2018-15797Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2018-15797Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-15797?
How severe is CVE-2018-15797?
How do I fix CVE-2018-15797?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-15791Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15792Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15793Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15794Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15795Pivotal CredHub Service Broker, versions prior to 1.1.0, use…8.1
- CVE-2018-15796Cloud Foundry Bits Service Release, versions prior to 2.14.0…8.1
- CVE-2018-15798Pivotal Concourse Release, versions 4.x prior to 4.2.2, logi…7.6
- CVE-2018-15799Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15800Cloud Foundry Bits Service, versions prior to 2.18.0, includ…8.1
- CVE-2018-15801Spring Security versions 5.1.x prior to 5.1.2 contain an aut…7.4
- CVE-2018-15802Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-15803Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
Are you affected by CVE-2018-15797?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST