Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-5414— App Autoscaler logs credentials

Quick assessment

Affected
VMware Tanzu PCF Autoscaling
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VMware Tanzu Application Service for VMs和VMware Tanzu Operations Manager都是美国威睿（VMware）公司的产品。VMware Tanzu Application Service for VMs是一套应用程序开发和部署解决方案。VMware Tanzu Operations Manager是一套Cloud Foundry自动化管理解决方案。该方案能够自动化部署、升级和管理Cloud Foundry平台。 VMware Tanzu Ope

AI Predicted 8.1 Difficulty: Moderate EPSS 0.71% · P52
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-5414

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
App Autoscaler logs credentials
Source: CVE Program / CVE List V5
Vulnerability Description
VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Tanzu Operations Manager和Tanzu Application Service for VMs 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Tanzu Application Service for VMs和VMware Tanzu Operations Manager都是美国威睿（VMware）公司的产品。VMware Tanzu Application Service for VMs是一套应用程序开发和部署解决方案。VMware Tanzu Operations Manager是一套Cloud Foundry自动化管理解决方案。该方案能够自动化部署、升级和管理Cloud Foundry平台。 VMware Tanzu Ope
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
VMware Tanzu PCF Autoscaling All ~ v232 -
VMware Tanzu Operations Manager 2.7 ~ 2.7.15 -
VMware Tanzu VMware Tanzu Application Service for VMs 2.9.x ~ 2.9.7 -

II. Public POCs for CVE-2020-5414

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-5414

请登录查看更多情报信息。

Other References for CVE-2020-5414 (1)

Same Patch Batch · VMware Tanzu · 2020-07-31 · 3 CVEs total

CVE-2019-11286 JMX Credential Deserialization in GemFire
CVE-2020-5396 JMX Insecure Default Configuration in GemFire

IV. Related Vulnerabilities

Same vendor: VMware Tanzu
Same weakness: CWE-200

V. Comments for CVE-2020-5414

No comments yet

Leave a comment