1. Home
  2. CVE Database
  3. CVE-2020-5426
CRITICAL · 9.8

CVE-2020-5426

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server ...

Vulnerability Description

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
VmwarePivotal Scheduler< 1.4.0

Related Weaknesses (CWE)

CWE-319

References

FAQ

What is CVE-2020-5426?

CVE-2020-5426 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server ...

How severe is CVE-2020-5426?

CVE-2020-5426 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-5426?

Check the references section above for vendor advisories and patch information. Affected products include: Vmware Pivotal Scheduler.