What’s Vulnerable › Vulnerabilities

CVE-2019-11283: Password leak in smbdriver logs

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-23 · updated 2026-06-17
• Weakness: CWE-532

Description

Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.

Affected products

• Cloud Foundry cf-deployment: before 12.2.0 — fixed in 12.2.0
• Pivotal Software Cloud Foundry Smb Volume: before 2.0.3 — fixed in 2.0.3

How to fix

Upgrade to a fixed version: Cloud Foundry cf-deployment 12.2.0; Pivotal Software Cloud Foundry Smb Volume 2.0.3. Check the vendor advisory for mitigations.

References

• https://www.cloudfoundry.org/blog/cve-2019-11283
• https://www.cloudfoundry.org/blog/cve-2019-11283

Get alerted when CVE-2019-11283 or the next vulnerability affects your stack