CVE-2018-15795

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.

Score

CVSS 3.0 8.1 High

Status

Modified - security_alert@emc.com

Published

2018-11-13

Last modified

2024-09-16

Weaknesses

CWE-338

Affected products

• Credhub Service Broker (Pivotal Cloud Foundry)
• Credhub Service Broker (Pivotal Software)

References

• http://www.securityfocus.com/bid/105915
• https://pivotal.io/security/cve-2018-15795