CVE-2019-3800

Name of the Vulnerable Software and Affected Versions CF CLI versions prior to 6.45.0

Description The issue allows a local authenticated malicious user with access to the CF CLI config file to act as the client who is the owner of the leaked credentials. This occurs because the CF CLI writes the client id and secret to its config file when the user authenticates with the --client-credentials flag.

Recommendations For CF CLI versions prior to 6.45.0, update to version 6.45.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CF CLI config file to minimize the risk of exploitation.