title: UAA password may appear in BOSH System Metrics Server process arguments
description: BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).
problem types: CWE-214: Invocation of Process Using Visible Sensitive Information
affected:
{
product: BOSH System Metrics Server
vendor: Cloud Foundry
versions:
lessThan: 0.1.0, status: affected, version: All, versionType: custom
}