Vulnerability in Cloud Foundry Capi
CVE-2020-5417
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (62.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 62nd percentile — 62.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Cloud Foundry Capi — versions All
- Cloud Foundry Cf Deployment — versions All
- Cloudfoundry Capi-Release
- Cloudfoundry Cf-Deployment
Weakness classification (CWE)
References
- www.cloudfoundry.org/blog/cve-2020-5417 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-5417?
- CVE-2020-5417 is a high-severity vulnerability in Cloud Foundry Capi, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2020-08-21.
- How severe is CVE-2020-5417?
- High severity. CVSS v3 base score is 8.8 out of 10.