CVE CVE-2018-15797 Mappings

Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CVE-2018-15797 NFS Volume Release primary_impact T1068 Exploitation for Privilege Escalation
CVE-2018-15797 NFS Volume Release exploitation_technique T1552 Unsecured Credentials