Skip to content
OpenAdvisories
High · 8.0 CVE-2020-5400 EUVD-2020-26579GHSA-m9cq-wcff-6m72

Cloud Controller logs environment variables from app manifests

Published Feb 27, 2020 · Updated Sep 17, 2024 · Assigned by pivotal

Description

Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.

Affected products

VendorProductAffectedFixed
Cloud Foundry CAPI unspecified – < 1.91.0 1.91.0

References