High severity · published Feb 12, 2020
CVE-2020-5399
Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS
7.4
CVSS
0.5%
EPSS
No
On KEV
Description
Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cloud Foundry Cf-deployment · Pivotal Software
before 12.29.0 · source: NVD
CR
Credhub · Cloudfoundry
before 2.5.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5399
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5399
Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2020-5399
More from Credhub
9.8
CVE-2019-3801
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building