CVE-2020-5422

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-5422
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5422.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-5422
Published
2020-10-02T17:15:12.537Z
Modified
2026-03-14T01:39:23.462004Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).

References

Affected packages

Git / github.com/cloudfoundry/bosh-system-metrics-server-release

Affected ranges

Type
GIT
Repo
https://github.com/cloudfoundry/bosh-system-metrics-server-release
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dfc7c87309f6ab91dd11b0e9d123a0877aa050a5
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.1.0"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.16
v0.0.17
v0.0.19
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.4
v0.0.6
v0.0.8
v0.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5422.json"