CVE-2020-5417
High
Description
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCloudfoundry Capi-release
PublishedAug 21, 2020
First seenAug 21, 2020
Weakness typeCWE-732CWE-732
How to fix
Update
- cloudfoundry capi-release1.97.0 or later
- cloudfoundry cf-deployment13.12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry capi-release | v < 1.97.0 | 1.97.0 |
| cloudfoundry cf-deployment | v < 13.12.0 | 13.12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.