CVE-2020-5414

🗓️ 31 Jul 2020 19:40:20Reported by pivotalType

VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs sensitive credentials, granting administrative privileges to authenticated users

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2020-5414 App Autoscaler logs credentials	31 Jul 202019:40	–	cvelist
EUVD	EUVD-2020-26584	7 Oct 202500:30	–	euvd
NVD	CVE-2020-5414	31 Jul 202020:15	–	nvd
OSV	CVE-2020-5414	31 Jul 202020:15	–	osv
Prion	Design/Logic Flaw	31 Jul 202020:15	–	prion

NVD

Node

vmware tanzu_application_service_for_virtual_machinesRange2.7.0–2.7.19

vmware tanzu_application_service_for_virtual_machinesRange2.8.0–2.8.13

vmware tanzu_application_service_for_virtual_machinesRange2.9.0–2.9.7

Node

vmware operations_managerRange2.7.0–2.7.15

vmware operations_managerRange2.8.0–2.8.6

vmware operations_managerRange2.9.0–2.9.1

[
  {
    "product": "PCF Autoscaling",
    "vendor": "VMware Tanzu",
    "versions": [
      {
        "lessThan": "v232",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Operations Manager",
    "vendor": "VMware Tanzu",
    "versions": [
      {
        "lessThan": "2.7.15",
        "status": "affected",
        "version": "2.7",
        "versionType": "custom"
      },
      {
        "lessThan": "2.8.6",
        "status": "affected",
        "version": "2.8",
        "versionType": "custom"
      },
      {
        "lessThan": "2.9.1",
        "status": "affected",
        "version": "2.9",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "VMware Tanzu Application Service for VMs",
    "vendor": "VMware Tanzu",
    "versions": [
      {
        "lessThan": "2.9.7",
        "status": "affected",
        "version": "2.9.x",
        "versionType": "custom"
      },
      {
        "lessThan": "2.7.19",
        "status": "affected",
        "version": "2.7.x",
        "versionType": "custom"
      },
      {
        "lessThan": "2.8.13",
        "status": "affected",
        "version": "2.8.x",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
tanzu	www.tanzu.vmware.com/security/cve-2020-5414

21 Nov 2024 05:34Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.7

CVSS 26

CVSS 35.7

EPSS0.00564