Medium · 4.3 CVE-2019-11294 EUVD-2019-2978GHSA-2443-wh6v-5rjf

CAPI leaks service broker URLs and GUIDs to space developers

Published Dec 19, 2019 · Updated Sep 17, 2024 · Assigned by pivotal

Description

Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.

Affected products

Vendor	Product	Affected	Fixed
Cloud Foundry	CAPI	1.88.0	—

References

https://www.cloudfoundry.org/blog/cve-2019-11294