What’s Vulnerable › Vulnerabilities

CVE-2019-3800: CF CLI writes the client id and secret to config file

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-08-05 · updated 2026-06-17
• Weakness: CWE-522

Description

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

Affected products

• Anynines Elasticsearch: before 2.1.2 — fixed in 2.1.2
• Anynines Logme: before 2.1.2 — fixed in 2.1.2
• Anynines Mongodb: before 2.1.2 — fixed in 2.1.2
• Anynines Mysql: before 2.1.2 — fixed in 2.1.2
• Anynines Postgresql: before 2.1.2 — fixed in 2.1.2
• Anynines Rabbitmq: before 2.1.2 — fixed in 2.1.2
• Anynines Redis: before 2.1.2 — fixed in 2.1.2
• Apigee Edge Service Broker: before 3.1.3 — fixed in 3.1.3
• Appdynamics Application Analytics: before 4.7.652 — fixed in 4.7.652
• Appdynamics Application Performance Monitoring: before 4.6.64 — fixed in 4.6.64
• Appdynamics Platform Montioring: before 4.7.712 — fixed in 4.7.712
• Bluemedora Nozzle: before 3.1.1 — fixed in 3.1.1
• Contrastsecurity Service Broker: before 2.2.0 — fixed in 2.2.0
• CyberArk Conjur Service Broker: before 1.1.1 — fixed in 1.1.1
• Datadoghq Application Monitoring: before 1.7.0 — fixed in 1.7.0
• datastax Enterprise Service Broker: before 1.0.2 — fixed in 1.0.2
• Dynatrace Service Broker: before 1.4.2 — fixed in 1.4.2
• ForgeRock Service Broker: before 2.1.2 — fixed in 2.1.2
• Google Cloud Platform Service Broker: before 4.2.3 — fixed in 4.2.3
• IBM Websphere Liberty : before 3.11.0 — fixed in 3.11.0
• Microsoft Azure Log Analytics Nozzle: before 1.4.1 — fixed in 1.4.1
• Microsoft Azure Service Broker: before 1.4.1 — fixed in 1.4.1
• Newrelic Dotnet Extension Buildpack: before 1.1.1 — fixed in 1.1.1
• Newrelic Nozzle: before 1.1.17 — fixed in 1.1.17
• Newrelic Service Broker: before 1.12.64 — fixed in 1.12.64
• Pagerduty Service Broker: before 1.2.4 — fixed in 1.2.4
• Pivotal Application Service: from 2.3.0 before 2.3.14; from 2.4.0 before 2.4.10; from 2.5.0 before 2.5.6 — fixed in 2.3.14, 2.4.10, 2.5.6
• Pivotal Cloud Foundry Autoscaling Release: before 219 — fixed in 219
• Pivotal Cloud Foundry Command Line Interface: before 6.45.0 — fixed in 6.45.0
• Pivotal Cloud Foundry Command Line Interface Release: before 1.16.0 — fixed in 1.16.0

How to fix

Upgrade to a fixed version: Anynines Elasticsearch 2.1.2; Anynines Logme 2.1.2; Anynines Mongodb 2.1.2; Anynines Mysql 2.1.2; Anynines Postgresql 2.1.2; Anynines Rabbitmq 2.1.2; Anynines Redis 2.1.2; Apigee Edge Service Broker 3.1.3; Appdynamics Application Analytics 4.7.652; Appdynamics Application Performance Monitoring 4.6.64; Appdynamics Platform Montioring 4.7.712; Bluemedora Nozzle 3.1.1. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2019-3800
• https://www.cloudfoundry.org/blog/cve-2019-3800
• https://pivotal.io/security/cve-2019-3800
• https://www.cloudfoundry.org/blog/cve-2019-3800

Get alerted when CVE-2019-3800 or the next vulnerability affects your stack