CVE-2017-4955
CriticalSummary
An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.6.x prior to 1.6.65, 1.7.x prior to 1.7.48, 1.8.x prior to 1.8.28, and 1.9.x prior to 1.9.5, where several credentials were present in the logs for the Notifications errand.
Risk Assessment
The presence of credentials in logs may lead to unauthorized access to the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update Pivotal PCF Elastic Runtime to the latest version to mitigate the vulnerability and secure the credentials.
Other vulnerabilities in Pivotal PCF Elastic Runtime
See all- CVE-2017-4959High
An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.8.x prior to 1.8.29 and 1.9.x prior to 1.9.7, allowing an authorized user to take over another user's account. This can lead to account lockout and potential privilege escalation.
- CVE-2017-2773Critical
An issue in Pivotal PCF Elastic Runtime allows unprivileged attackers to impersonate other users due to incomplete validation in JSON Web Token (JWT) libraries. This affects versions 1.6.x prior to 1.6.60, 1.7.x prior to 1.7.41, 1.8.x prior to 1.8.23, and 1.9.x prior to 1.9.1.
Original NVD description (English source)
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9.x versions prior to 1.9.5. Several credentials were present in the logs for the Notifications errand in the PCF Elastic Runtime tile.