Vulnerability · Published Dec 2, 2020 · Assigned by pivotal
CVE-2020-5423Cloud Controller is vulnerable to denial of service via YAML parsing
High 7.5
In plain English
A high-severity uncontrolled resource consumption in CAPI from Cloud Foundry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)1.1%top 33.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry | CAPI | All – before 1.101.0 |
| Cloud Foundry | CF Deployment | All – before 15.0.0 |
Weakness: CWE-400 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.cloudfoundry.org/blog/cve-2020-5423 x_refsource_CONFIRM