Vulnerability · Published Aug 21, 2020 · Assigned by pivotal

CVE-2020-5417Cloud Controller may allow developers to claim sensitive routes

High 8.5

In plain English

A high-severity incorrect permission assignment in CAPI from Cloud Foundry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.0)8.5High

Exploit odds (30 days)1.0%top 37.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.

Affected products (as reported)

Vendor	Product	Versions
Cloud Foundry	CAPI	All – before 1.97.0
Cloud Foundry	CF Deployment	All – before 13.12.0

Weakness: CWE-732 · Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.cloudfoundry.org/blog/cve-2020-5417 x_refsource_CONFIRM