Log in Start free

Vulnerability · Published Jul 31, 2020 · Assigned by pivotal

CVE-2020-5414App Autoscaler logs credentials

Medium 5.7

In plain English

A medium-severity information exposure in Operations Manager from VMware Tanzu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.0)5.7Medium
Exploit odds (30 days)0.7%top 46.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.

Affected products (as reported)

VendorProductVersions
VMware Tanzu PCF Autoscaling All – before v232
VMware Tanzu Operations Manager 2.7 – before 2.7.152.8 – before 2.8.62.9 – before 2.9.1
VMware Tanzu VMware Tanzu Application Service for VMs 2.9.x – before 2.9.72.7.x – before 2.7.192.8.x – before 2.8.13

Weakness: CWE-200 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H

References