PivotalCVELIST:CVE-2020-5400CVE-2020-5400 Cloud Controller logs environment variables from app manifests
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
6.4 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.5%
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
CNA Affected
[
{
"product": "CAPI",
"vendor": "Cloud Foundry",
"versions": [
{
"lessThan": "1.91.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]References
Related
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
6.4 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.5%