JFrog credentials shown in plain text
search cancel

JFrog credentials shown in plain text

book

Article ID: 315981

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

Earlier versions of Cloud Proxy for vRealize Automation Cloud, VMware Aria Operations for Logs (SaaS), vRealize AI Cloud and vRealize Subscription Manager Cloud contain unrestricted scripts access, leading to JFrog credentials to be exposed in plain text.

Cause

This issue is caused by unrestricted scripts access in earlier versions of Cloud Proxy for vRealize Automation Cloud, VMware Aria Operations for Logs (SaaS), vRealize AI Cloud and vRealize Subscription Manager Cloud.

Resolution

This is a known issue affecting vRealize Automation Cloud, VMware Aria Operations for Logs (SaaS), vRealize AI Cloud and vRealize Subscription Manager Cloud.

To resolve the issue immediately, preform a guest reboot on your Cloud Proxies.
This will trigger an update on the Cloud Proxy after restart.

Additional Information

Impact/Risks:
This exploit can lead to JFrog credentials, including Repository Url, Username, and password being shared in plain text.