CVE-2020-5399

Published: Feb 12, 2020Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.

Affected (2)

Products: Cloudfoundry: Credhub · Pivotal Software: Cloud Foundry Cf Deployment

1 product

Pivotal Software

1 product

Cloud Foundry Cf Deployment

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Credhub	Before 2.5.10
Pivotal Software Cloud Foundry Cf Deployment	Before 12.29.0

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (2)

https://www.cloudfoundry.org/blog/cve-2020-5399

Source: security@pivotal.io

Vendor Advisory

https://www.cloudfoundry.org/blog/cve-2020-5399

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.