CVE-2019-3780: cloud foundry cloud foundry container runtime (cfcr) Password in Configuration File
Vulnerability summary
CVE-2019-3780 is a critical (CVSS 9.1) Password in Configuration File vulnerability in cloud foundry cloud foundry container runtime (cfcr). EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities.
Timeline
- 08-03-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST9.1CriticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-260Password in Configuration FileThe product stores a password in a configuration file that might be accessible to actors who do not know the password.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Cloud foundry1 product
- cloud foundry container runtime (cfcr)≥ All, < v0.28.0
Cloudfoundry1 product
- container_runtime< 0.28.0
2 vendors · 2 products