CVE-2020-5418: Cloud Controller allows users with no roles to list droplets
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloudcontroller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-5418?
CVE-2020-5418 is a vulnerability in Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0.
How does CVE-2020-5418 affect Cloud Foundry CAPI?
CVE-2020-5418 allows authenticated users with only the "cloud_controller.read" scope to list all droplets in all spaces, even if they have no roles in those spaces.
What is the severity of CVE-2020-5418?
CVE-2020-5418 has a severity rating of medium with a value of 4.3.
Which software versions are affected by CVE-2020-5418?
Cloud Foundry CAPI versions prior to 1.98.0 and Cloud Foundry cf-deployment versions up to exclusive 13.17.0 are affected.
How can I fix CVE-2020-5418?
To fix CVE-2020-5418, upgrade Cloud Foundry CAPI to version 1.98.0 or higher.