Cloud Foundry bosh system metrics server vulnerabilities

Latest Cloud Foundry bosh system metrics server CVEs

Newest publication first

1. CVE-2020-5422 UAA password may appear in BOSH System Metrics Server process arguments

   Published 2020-10-02

   Medium·CVSS 6.5 EPSS 0.92%

   BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.