CVE-2020-5426

Scheduler for TAS can transmit privileged UAA token in plaintext

State: Published
Severity: 8.6 High
Published: Nov 11, 2020
Updated: Sep 17, 2024
Reserved: Jan 3, 2020

Description

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.

Scores

CVSS	Score	Vector	Source
3.0	8.6 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	pivotal

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
Pivotal SchedulerVMware Tanzu	All to before 1.4.0Affected

References

https://tanzu.vmware.com/security/cve-2020-5426

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.