CVE-2020-5406— PCF Autoscaling logs its database credentials
Quick assessment
Affected
Pivotal VMware Tanzu Application Service for VMs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VMware Tanzu Application Service for VMs是美国威睿（VMware）公司的一套应用程序开发和部署解决方案。 VMware Tanzu Application Service for VMs 2.6.18之前的2.6.x版本、2.7.11之前的2.7.x版本和2.8.5之前的2.8.x版本中存在安全漏洞。攻击者可利用该漏洞获取数据库未授权的访问权限。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-5406
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PCF Autoscaling logs its database credentials
Source: CVE Program / CVE List V5
Vulnerability Description
VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Tanzu Application Service for VMs 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Tanzu Application Service for VMs是美国威睿（VMware）公司的一套应用程序开发和部署解决方案。 VMware Tanzu Application Service for VMs 2.6.18之前的2.6.x版本、2.7.11之前的2.7.x版本和2.8.5之前的2.8.x版本中存在安全漏洞。攻击者可利用该漏洞获取数据库未授权的访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Pivotal | VMware Tanzu Application Service for VMs | 2.8.x ~ 2.8.5 | - |
|
II. Public POCs for CVE-2020-5406
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-5406
请登录查看更多情报信息。
Other References for CVE-2020-5406 (1)
-
https://tanzu.vmware.com/security/cve-2020-5406 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: Pivotal
-
CVE-2020-5409
Concourse Open Redirect in the /sky/login endpoint -
CVE-2020-5403
DoS Via Malformed URL with Reactor Netty HTTP Server -
CVE-2020-5404
Authentication Leak On Redirect With Reactor Netty HttpClien -
CVE-2019-11288
tcServer JMX Socket Listener Registry Rebinding Local Privil -
CVE-2013-6430
Pivotal Software Spring Framework‘JavaScriptUtils.javaScript
Same weakness: CWE-522
-
CVE-2026-100298
Insufficiently Protected Credentials in Anjvision YSSD-RTMP- -
CVE-2026-81930
Apache Airflow Snowflake provider: Unvalidated account field -
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil -
CVE-2026-100569
OpenClaw before 2026.8.1 Credential Exposure via Endpoint Ov -
CVE-2026-92680
Araxis Merge insufficiently protected credentials
V. Comments for CVE-2020-5406
No comments yet