« Volver al listado

CVE-2020-5400

Estado: ModificadaMedia (6.5)—

Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cloudfoundry — Capi-releaseCloudfoundry — Cf-deployment

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-5400",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@pivotal.io",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.3
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@pivotal.io",
      "affectedData": [
        {
          "vendor": "Cloud Foundry",
          "product": "CAPI",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.91.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-27T20:15:11.423",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2020-5400",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@pivotal.io"
    },
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2020-5400",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@pivotal.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials."
    },
    {
      "lang": "es",
      "value": "Cloud Foundry Cloud Controller (CAPI), versiones anteriores a 1.91.0, registra las propiedades de background jobs cuando se ejecutan, lo que puede incluir información confidencial tales como credenciales si se proporcionaron al trabajo. Un usuario malicioso con acceso a esos registros puede conseguir acceso no autorizado a recursos protegidos por tales credenciales."
    }
  ],
  "lastModified": "2026-06-17T03:21:25.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudfoundry:capi-release:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8866A338-CD09-42BA-A806-475DA78E8D37",
              "versionEndExcluding": "1.91.0"
            },
            {
              "criteria": "cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "434D7E36-293E-4E3D-8C01-04F27397ED5C",
              "versionEndExcluding": "12.33.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@pivotal.io"
}