Guessable Random Number Generation in Pivotal CredHub Service Broker UAA Client Secret

CVE-2018-15795 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:P/A:N

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.

Learn more about our User Device Pen Test.