CVE-2019-3786

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.

Published : 2019-04-24 16:29 Updated : 2019-10-09 23:49

4.0
CVSS Score More info
Score 4.0 / 10
4.0
Vendor Product Version URI
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc201
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc203
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc204
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc205
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc206
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc207
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc208
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc209
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc210
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc211
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc212
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc213
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc214
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc215
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc216
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc217
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc218
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc219
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc220
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc221
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc222
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc223
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc224
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc225
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc226
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc227
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc228
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc229
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc230
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc231
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc232
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc233
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc234
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc235
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc236
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc237
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc238
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc239
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc240
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc241
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc242
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc243
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc244
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc245
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc246
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc247
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc248
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc249
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc250
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc251
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc252
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc253
Cloudfoundry Bosh Backup And Restore 0.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.0:rc254
Cloudfoundry Bosh Backup And Restore 0.1.1 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.1:rc11
Cloudfoundry Bosh Backup And Restore 0.1.2 cpe:/a:cloudfoundry:bosh_backup_and_restore:0.1.2
Cloudfoundry Bosh Backup And Restore 1.0.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.0.0:-
Cloudfoundry Bosh Backup And Restore 1.0.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.0.0:beta1.3
Cloudfoundry Bosh Backup And Restore 1.0.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.0.0:beta4
Cloudfoundry Bosh Backup And Restore 1.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.0:-
Cloudfoundry Bosh Backup And Restore 1.1.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.0:alpha
Cloudfoundry Bosh Backup And Restore 1.1.1 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.1
Cloudfoundry Bosh Backup And Restore 1.1.2 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.2
Cloudfoundry Bosh Backup And Restore 1.1.3 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.3
Cloudfoundry Bosh Backup And Restore 1.1.4 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.4
Cloudfoundry Bosh Backup And Restore 1.1.5 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.5
Cloudfoundry Bosh Backup And Restore 1.1.6 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.1.6
Cloudfoundry Bosh Backup And Restore 1.2.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.0
Cloudfoundry Bosh Backup And Restore 1.2.1 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.1
Cloudfoundry Bosh Backup And Restore 1.2.2 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.2
Cloudfoundry Bosh Backup And Restore 1.2.3 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.3
Cloudfoundry Bosh Backup And Restore 1.2.4 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.4
Cloudfoundry Bosh Backup And Restore 1.2.6 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.6
Cloudfoundry Bosh Backup And Restore 1.2.7 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.7
Cloudfoundry Bosh Backup And Restore 1.2.8 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.2.8
Cloudfoundry Bosh Backup And Restore 1.3.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.3.0
Cloudfoundry Bosh Backup And Restore 1.3.1 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.3.1
Cloudfoundry Bosh Backup And Restore 1.3.2 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.3.2
Cloudfoundry Bosh Backup And Restore 1.4.0 cpe:/a:cloudfoundry:bosh_backup_and_restore:1.4.0
  1. Cloudfoundry (1) Search CVE
    1. Bosh Backup And Restore (23) Search CVE
      1. 0.1.0
      2. 0.1.1
      3. 0.1.2
      4. 1.0.0
      5. 1.1.0
      6. 1.1.1
      7. 1.1.2
      8. 1.1.3
      9. 1.1.4
      10. 1.1.5
      11. 1.1.6
      12. 1.2.0
      13. 1.2.1
      14. 1.2.2
      15. 1.2.3
      16. 1.2.4
      17. 1.2.6
      18. 1.2.7
      19. 1.2.8
      20. 1.3.0
      21. 1.3.1
      22. 1.3.2
      23. 1.4.0

CWE

ID Name Description Links
CWE-287 Improper Authentication When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. CVE

Reference

History of changes

Date Event
2019-10-09 23:49
2019-05-01 18:25
2019-04-24 16:29

New CVE