Vulnerability · Published Feb 12, 2020 · Assigned by pivotal
CVE-2020-5399CredHub does not properly enable TLS for MySQL database connections
High 7.6
In plain English
A high-severity security flaw in CredHub from Cloud Foundry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.0)7.6High
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry | CredHub | Edge – before 2.5.10 |
Weakness: CWE-319 · Vector: CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://www.cloudfoundry.org/blog/cve-2020-5399 x_refsource_CONFIRM