Lucene search

PivotalCVE-2020-5399

HistoryFeb 12, 2020 - 9:15 p.m.

CVE-2020-5399

2020-02-1221:15:14

CWE-319

pivotal

web.nvd.nist.gov

cve-2020-5399

cloud foundry

credhub

mysql

tls

nvd

security vulnerability

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.

Affected configurations

Nvd

Node

cloudfoundrycredhubRange<2.5.10

pivotal_softwarecloud_foundry_cf-deploymentRange<12.29.0

VendorProductVersionCPE
cloudfoundrycredhub*cpe:2.3:a:cloudfoundry:credhub:*:*:*:*:*:*:*:*
pivotal_softwarecloud_foundry_cf-deployment*cpe:2.3:a:pivotal_software:cloud_foundry_cf-deployment:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cloudfoundry	credhub	*	cpe:2.3:a:cloudfoundry:credhub::::::::
pivotal_software	cloud_foundry_cf-deployment	*	cpe:2.3:a:pivotal_software:cloud_foundry_cf-deployment::::::::

CNA Affected

[
  {
    "product": "CredHub",
    "vendor": "Cloud Foundry",
    "versions": [
      {
        "lessThan": "2.5.10",
        "status": "affected",
        "version": "Edge",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cloudfoundry.org/blog/cve-2020-5399

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for CVE-2020-5399