title: PCF Autoscaling logs its database credentials
description: VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.
problem types: CWE-522: Insufficiently Protected Credentials
affected:
{
product: VMware Tanzu Application Service for VMs
vendor: Pivotal
versions:
lessThan: 2.8.5, status: affected, version: 2.8.x, versionType: custom
lessThan: 2.7.11, status: affected, version: 2.7.x, versionType: custom
lessThan: 2.6.18, status: affected, version: 2.6.x, versionType: custom
}