Vulnerability in Cloud Foundry Capi
CVE-2020-5417
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
EPSS: 0.010 (60.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cloud Foundry Capi — versions All
- Cloud Foundry Cf Deployment — versions All
- Cloudfoundry Capi-release
- Cloudfoundry Cf-deployment
Weakness classification (CWE)
References
- security@pivotal.io (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-5417?
- CVE-2020-5417 is a high-severity vulnerability in Cloud Foundry Capi, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2020-08-21.
- How severe is CVE-2020-5417?
- High severity. CVSS v3 base score is 8.8 out of 10.