CVE-2016-9882

High

Published: 13/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Cloud Foundry prior to version v250 and CAPI-release prior to v1.12.0 related to logging credentials returned from service brokers. These credentials are logged in Cloud Controller system component logs and often sent to a log aggregator via syslog.

Risk Assessment

Logged credentials may be intercepted by unauthorized individuals, posing a risk of unauthorized access to services. Organizations may be exposed to data leaks and other security-related attacks.

Recommendation

It is recommended to upgrade to cf-release version v250 or later and CAPI-release version v1.12.0 or later to mitigate this vulnerability. Additionally, consider reviewing and securing logs to limit access to sensitive information.

Other vulnerabilities in Cloud Controller

CVE-2016-5006Critical
The Cloud Controller in Cloud Foundry before version 239 logs user-provided service objects at creation, allowing attackers to obtain sensitive user credential information via unspecified vectors.

Original NVD description (English source)

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log aggregator via syslog.