{"id":"CVE-2019-3800","aliases":["EUVD-2019-13427","GHSA-2wpx-p7qg-954w"],"status":"published","title":"CF CLI  writes the client id and secret to config file","description":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.","severity":{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02088,"percentile":0.81837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-522"],"published":"2019-08-05T16:38:20Z","modified":"2026-10-24T10:30:16Z","products":[{"vendor":"anynines","product":"elasticsearch"},{"vendor":"anynines","product":"logme"},{"vendor":"anynines","product":"mongodb"},{"vendor":"anynines","product":"mysql"},{"vendor":"anynines","product":"postgresql"},{"vendor":"anynines","product":"rabbitmq"},{"vendor":"anynines","product":"redis"},{"vendor":"apigee","product":"edge_service_broker"},{"vendor":"appdynamics","product":"application_analytics"},{"vendor":"appdynamics","product":"application_performance_monitoring"},{"vendor":"appdynamics","product":"platform_montioring"},{"vendor":"bluemedora","product":"nozzle"},{"vendor":"cloud foundry","product":"cf cli"},{"vendor":"cloud foundry","product":"cf cli release"},{"vendor":"contrastsecurity","product":"service_broker"},{"vendor":"cyberark","product":"conjur_service_broker"},{"vendor":"datadoghq","product":"application_monitoring"},{"vendor":"datastax","product":"enterprise_service_broker"},{"vendor":"dynatrace","product":"service_broker"},{"vendor":"forgerock","product":"service_broker"},{"vendor":"google","product":"google_cloud_platform_service_broker"},{"vendor":"ibm","product":"websphere_liberty_"},{"vendor":"microsoft","product":"azure_log_analytics_nozzle"},{"vendor":"microsoft","product":"azure_service_broker"},{"vendor":"newrelic","product":"dotnet_extension_buildpack"},{"vendor":"newrelic","product":"nozzle"},{"vendor":"newrelic","product":"service_broker"},{"vendor":"pagerduty","product":"service_broker"},{"vendor":"pivotal","product":"application_service"},{"vendor":"pivotal","product":"cloud_foundry_autoscaling_release"},{"vendor":"pivotal","product":"cloud_foundry_command_line_interface"},{"vendor":"pivotal","product":"cloud_foundry_command_line_interface_release"},{"vendor":"pivotal","product":"cloud_foundry_deployment"},{"vendor":"pivotal","product":"cloud_foundry_deployment_concourse_tasks"},{"vendor":"pivotal","product":"cloud_foundry_event_alerts"},{"vendor":"pivotal","product":"cloud_foundry_healthwatch"},{"vendor":"pivotal","product":"cloud_foundry_log_cache_release"},{"vendor":"pivotal","product":"cloud_foundry_networking_release"},{"vendor":"pivotal","product":"cloud_foundry_notifications"},{"vendor":"pivotal","product":"cloud_foundry_routing_release"},{"vendor":"pivotal","product":"cloud_foundry_smoke_test"},{"vendor":"pivotal","product":"credhub_service_broker_for_pcf"},{"vendor":"pivotal","product":"metric_registrar_release"},{"vendor":"pivotal","product":"on_demand_service_broker"},{"vendor":"pivotal","product":"pivotal_cloud_foundry_service_broker"},{"vendor":"pivotal","product":"single_sign-on"},{"vendor":"riverbed","product":"steelcentral_appinternals"},{"vendor":"samba","product":"volume_service"},{"vendor":"signalsciences","product":"service_broker"},{"vendor":"snyk","product":"service_broker"},{"vendor":"solace","product":"pubsub\\+"},{"vendor":"splunk","product":"nozzle"},{"vendor":"sumologic","product":"nozzle"},{"vendor":"synopsys","product":"seeker_iast_service_broker"},{"vendor":"tibco","product":"businessworks_buildpack"},{"vendor":"wavefront","product":"wavefront_by_vmware_nozzle"},{"vendor":"yugabyte","product":"db_enterprise"}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2019-3800","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://pivotal.io/security/cve-2019-3800","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3800"},{"url":"https://github.com/advisories/GHSA-2wpx-p7qg-954w"}],"sources":{"cve":[{"id":"CVE-2019-3800","title":"CF CLI  writes the client id and secret to config file","description":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.","status":"published","published":"2019-08-05T16:38:20.424Z","modified":"2024-09-17T04:29:08.973Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13427","description":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.","status":"published","published":"2019-08-05T16:38:20Z","modified":"2024-09-17T04:29:08Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:23.116921Z"}],"ghsa":[{"id":"GHSA-2wpx-p7qg-954w","title":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to...","description":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.","status":"published","published":"2022-05-24T16:52:34Z","modified":"2024-04-04T01:33:09Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:55:59.478045Z"}],"nvd":[{"id":"CVE-2019-3800","description":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.","status":"published","published":"2019-08-05T17:15:10.96Z","modified":"2026-06-17T02:35:36.973Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-522","CWE-200"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-3800","description":"CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.","status":"published","published":"2019-08-05T17:15:10.96Z","modified":"2026-10-24T10:30:16.965001721Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"}]}}