CVE-2020-5418CWE-863

Cloud Controller allows users with no roles to list droplets

Low · published September 3, 2020

CVSS v3.0
3.1
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).

The record
Technical detail
CVSS v3.0
3.1 · LOW
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2020-09-03T01:10Z
EPSS history
Timeline
  • 03 SEP 01:10Z
    Cloud Controller allows users with no roles to list droplets
    cvelistv5