CVE-2019-11283: high-severity vulnerability in Cloud Foundry SMB Volume
Password leak in smbdriver logs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.5%
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CVEs — Cloud Foundry SMB Volume
In the same product, most dangerous first.
CVE-2019-11277HIGHVolume Services is vulnerable to an LDAP injection attackEPSS 1.7%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2019-11282MEDIUMUAA is vulnerable to a Blind SCIM injection leading to information disclosureEPSS 1.1%CVE-2020-5417HIGHCloud Controller may allow developers to claim sensitive routesEPSS 1.0%