CVE-2020-5400
Cloud Controller logs environment variables from app manifests
- State
- Published
- Severity
- 8.0 High
- Published
- Feb 27, 2020
- Updated
- Sep 17, 2024
- Reserved
- Jan 3, 2020
Description
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 8.0 High | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | pivotal |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
CAPICloud Foundry |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.