CVE-2020-5422 — UAA password may appear in BOSH System Metrics Server process arguments

CVE-2020-5422

UAA password may appear in BOSH System Metrics Server process arguments PUBLISHED

Description (CNA)

BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).

Affected (CNA)

Vendor / product	Versions
Cloud Foundry / BOSH System Metrics Server	affected All before 0.1.0

CWE

CWE-214

References

https://www.cloudfoundry.org/blog/cve-2020-5422

ADP enrichment

CVE

No English description supplied.

https://www.cloudfoundry.org/blog/cve-2020-5422