BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bosh_system_metrics_server | Cloud_foundry | * | 0.1.0 (excluding) |