CVE-2020-5418: falha de baixa gravidade em Cloud Foundry CAPI
Cloud Controller allows users with no roles to list droplets
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.1epss 0.6%
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVEs relacionadas — Cloud Foundry CAPI
No mesmo produto, das mais perigosas para as menos.
CVE-2019-11277HIGHVolume Services is vulnerable to an LDAP injection attackEPSS 1.7%CVE-2019-11283HIGHPassword leak in smbdriver logsEPSS 1.5%CVE-2019-3785MEDIUMCloud Controller provides signed URL with write authorization to read only userEPSS 1.3%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%