CVE-2020-5417
Cloud Controller may allow developers to claim sensitive routes
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
Cloud Foundry CAPI (Cloud Controller), versiones anteriores a 1.97.0, cuando se usaba en una implementación donde un dominio de aplicación también es el dominio del sistema (lo cual es cierto en el manifiesto Deployment CF predeterminado), eran vulnerables a los desarrolladores que reclamaban maliciosa o accidentalmente determinadas rutas confidenciales, resultando potencialmente en que la aplicación del desarrollador manejara algunas peticiones que se esperaba que fueran a determinados componentes del sistema.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-03 CVE Reserved
- 2020-08-21 CVE Published
- 2023-03-07 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.cloudfoundry.org/blog/cve-2020-5417 | 2021-08-17 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cloudfoundry Search vendor "Cloudfoundry" | Capi-release Search vendor "Cloudfoundry" for product "Capi-release" | < 1.97.0 Search vendor "Cloudfoundry" for product "Capi-release" and version " < 1.97.0" | - |
Affected
| ||||||
Cloudfoundry Search vendor "Cloudfoundry" | Cf-deployment Search vendor "Cloudfoundry" for product "Cf-deployment" | < 13.12.0 Search vendor "Cloudfoundry" for product "Cf-deployment" and version " < 13.12.0" | - |
Affected
|