CVE-2020-5406

Published: Apr 10, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.

Affected (3)

Products: Vmware: Tanzu Application Service For Vms

Vmware

1 product

Tanzu Application Service For Vms

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Tanzu Application Service For Vms	From 2.6.0 to 2.6.18
Vmware Tanzu Application Service For Vms	From 2.7.0 to 2.7.11
Vmware Tanzu Application Service For Vms	From 2.8.0 to 2.8.5

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://tanzu.vmware.com/security/cve-2020-5406

Source: security@pivotal.io

Vendor Advisory

https://tanzu.vmware.com/security/cve-2020-5406

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.