title: CredHub CLI writes environment variable credentials to disk
description: Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.
problem types: CWE-522: Insufficiently Protected Credentials
affected:
{
product: CredHub CLI
vendor: Cloud Foundry
versions:
lessThan: 2.2.1, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.0
]