CVE-2020-5400: falha de alta gravidade em Cloud Foundry CAPI
Cloud Controller logs environment variables from app manifests
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8epss 0.8%
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
Cloud Foundry · CAPICVEs relacionadas — Cloud Foundry CAPI
No mesmo produto, das mais perigosas para as menos.
CVE-2019-3785MEDIUMCloud Controller provides signed URL with write authorization to read only userEPSS 1.3%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2020-5417HIGHCloud Controller may allow developers to claim sensitive routesEPSS 1.0%CVE-2019-11294MEDIUMCAPI leaks service broker URLs and GUIDs to space developersEPSS 0.8%CVE-2020-5418LOWCloud Controller allows users with no roles to list dropletsEPSS 0.6%