CVE-2020-5423CWE-400

Cloud Controller is vulnerable to denial of service via YAML parsing

High · published December 2, 2020

CVSS v3.0
7.5
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01145 · 66.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2020-12-02T01:55Z
EPSS history
Timeline
  • 02 DEC 01:55Z
    Cloud Controller is vulnerable to denial of service via YAML parsing
    cvelistv5