1. Home
  2. CVE Database
  3. CVE-2020-5399
HIGH · 7.4

CVE-2020-5399

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL dat...

Vulnerability Description

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
CloudfoundryCredhub< 2.5.10
Pivotal SoftwareCloud Foundry Cf-Deployment< 12.29.0

Related Weaknesses (CWE)

CWE-319

References

FAQ

What is CVE-2020-5399?

CVE-2020-5399 is a vulnerability with a CVSS score of 7.4 (HIGH). Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL dat...

How severe is CVE-2020-5399?

CVE-2020-5399 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-5399?

Check the references section above for vendor advisories and patch information. Affected products include: Cloudfoundry Credhub, Pivotal Software Cloud Foundry Cf-Deployment.