Описание
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 12.12.0 (исключая)Версия до 74.10.0 (исключая)
Одно из
cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:user_account_and_authentication:*:*:*:*:*:*:*:*
EPSS
Процентиль: 68%
0.00567
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-532
CWE-532
Связанные уязвимости
github
больше 3 лет назад
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.
EPSS
Процентиль: 68%
0.00567
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-532
CWE-532