CVE-2020-5422

UAA password may appear in BOSH System Metrics Server process arguments

State: Published
Severity: Not scored
Published: Oct 2, 2020
Updated: Sep 17, 2024
Reserved: Jan 3, 2020

Description

BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).

Scores

The record has no CVSS score.

Weaknesses

CWE-214 Invocation of Process Using Visible Sensitive Information

Affected Products

Product	Versions
BOSH System Metrics ServerCloud Foundry	All to before 0.1.0Affected

References

https://www.cloudfoundry.org/blog/cve-2020-5422

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.