Lucene search

PivotalCVELIST:CVE-2020-5418

HistorySep 03, 2020 - 1:10 a.m.

CVE-2020-5418 Cloud Controller allows users with no roles to list droplets

2020-09-0301:10:15

CWE-863

pivotal

www.cve.org

cve-2020-5418

cloud foundry capi

authenticated users

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the “cloud_controller.read” scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).

CNA Affected

[
  {
    "product": "CAPI",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "lessThan": "1.98.0",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "CF Deployment",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "lessThan": "13.17.0",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cloudfoundry.org/blog/cve-2020-5418

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVELIST:CVE-2020-5418