CVE-2020-5417: falha de alta gravidade em Cloud Foundry CAPI
Cloud Controller may allow developers to claim sensitive routes
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 1.0%
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVEs relacionadas — Cloud Foundry CAPI
No mesmo produto, das mais perigosas para as menos.
CVE-2019-11277HIGHVolume Services is vulnerable to an LDAP injection attackEPSS 1.7%CVE-2019-11283HIGHPassword leak in smbdriver logsEPSS 1.5%CVE-2019-3785MEDIUMCloud Controller provides signed URL with write authorization to read only userEPSS 1.3%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%