title: Password leak in smbdriver logs
description: Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.
problem types: CWE-532: Inclusion of Sensitive Information in Log Files
affected:
{
product: SMB Volume
vendor: Cloud Foundry
versions:
lessThan: v2.0.3, status: affected, version: All, versionType: custom
}
{
product: CF Deployment
vendor: Cloud Foundry
versions:
lessThan: v12.2.0, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]