CVE-2019-3800
CWE-522Published: August 5, 2019· Updated: Jun 17, 2026
Official Description
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
Technical Analysis
CVE-2019-3800 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (4)
Quick Facts
Related CVEs (CWE-522)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2019-3800 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts