Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2020-5418

Cloud Controller allows users with no roles to list droplets

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
pivotal

Description

Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cloud Foundry CAPI

  • All to < 1.98.0affected

Cloud Foundry CF Deployment

  • All to < 13.17.0affected

References