PT-2020-18469 · Cloud Foundry · Cloud Foundry Capi

Published 2020-08-21 · Updated 2021-08-17 · CVE-2020-5417

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry CAPI (Cloud Controller) versions prior to 1.97.0

Description The issue allows developers to maliciously or accidentally claim certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components. This occurs when the Cloud Foundry CAPI is used in a deployment where an app domain is also the system domain, which is true in the default CF Deployment manifest.

Recommendations For versions prior to 1.97.0, update to version 1.97.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive routes to prevent malicious or accidental claims by developers.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-5417

Affected Products

Cloud Foundry Capi

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-5417 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5417 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2020-5417 · Vendor Advisory
• https://t.me/cvenotify/19529 · Telegram Post