CVE-2021-22115

Name of the Vulnerable Software and Affected Versions Cloud Controller API versions prior to 1.106.0

Description The issue concerns the logging of service broker credentials in plain text. Specifically, when the default value of the db logging config field is changed, the Cloud Controller API logs service broker credentials. Additionally, the CAPI database logs the service broker password in plain text whenever a job to clean up orphaned items is run by the Cloud Controller.

Recommendations For Cloud Controller API versions prior to 1.106.0, update to version 1.106.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CAPI database logs to minimize the risk of exploitation. Avoid changing the default value of the db logging config field until the issue is resolved.