CVE-2020-5422

Name of the Vulnerable Software and Affected Versions BOSH System Metrics Server versions prior to 0.1.0

Description The issue exposes the UAA password as a flag to a process running on the BOSH director, making it accessible to any user or process with access to the same VM. This can be done through commands like ps or by looking at process details.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the BOSH director VM to minimize the risk of password exposure.