CVE-2020-5400 Cloud Controller logs environment variables from app manifests
Cloud Foundry Cloud Controller logs sensitive environment variables, allowing attackers with log access to steal credentials and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-5400?
CVE-2020-5400 is a high-severity vulnerability in Cloud Foundry CAPI, published on 27 Feb 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
Which versions are affected by CVE-2020-5400?
It affects 2 products.
Products include Cloudfoundry Capi-Release, Cloudfoundry Cf-Deployment.
How do I fix CVE-2020-5400?
No fix has been published for CVE-2020-5400 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-5400 being exploited?
There is no known exploitation of CVE-2020-5400 in the wild and no public exploit code.
Other vulnerabilities in Cloud Foundry CAPI
- CVE-2018-1195 Auth bypass in Cloud Controller
- CVE-2020-5417 Cloud Controller may allow developers to claim sensitive routes
- CVE-2023-20881 Missing authorization in Cloud Controller API
- CVE-2018-1266 Path traversal in n/a
- CVE-2017-8033 Path traversal in Cloud Controller API CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268
Sources
Also known as GHSA-m9cq-wcff-6m72.