CVE-2020-5400: high-severity vulnerability in Cloud Foundry CAPI
Cloud Controller logs environment variables from app manifests
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 0.8%
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
Cloud Foundry · CAPIRelated CVEs — Cloud Foundry CAPI
In the same product, most dangerous first.
CVE-2019-3785MEDIUMCloud Controller provides signed URL with write authorization to read only userEPSS 1.3%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2020-5417HIGHCloud Controller may allow developers to claim sensitive routesEPSS 1.0%CVE-2019-11294MEDIUMCAPI leaks service broker URLs and GUIDs to space developersEPSS 0.8%CVE-2020-5418LOWCloud Controller allows users with no roles to list dropletsEPSS 0.6%